Treat empty workload identity tokens as absent

[sylvesterkaczmarek]

Summary

Treat an empty ANTHROPIC_IDENTITY_TOKEN as absent instead of selecting workload identity federation with an empty assertion.

The direct federation credential chain currently detects a literal identity token with an environment-membership check. That treats ANTHROPIC_IDENTITY_TOKEN="" as a configured credential. When the federation rule and organization variables are also set, this can select the federation path ahead of fallback credentials and eventually attempt a token exchange with an empty assertion.

The same gap exists after provider construction: the env-backed identity-token provider re-reads the variable on every exchange so token rotation is supported, but it only rejects a missing variable. If a previously valid variable is rotated to an empty string, the provider can again attempt an empty assertion.

Fix

Use a truthy value when deciding whether a literal identity token is available, matching the credential chain's handling of other environment variables.

The env-backed provider also rejects both missing and empty values when it re-reads the token at exchange time.

An explicitly configured ANTHROPIC_IDENTITY_TOKEN_FILE still takes precedence and remains usable when the literal token variable is present but empty.

Regression coverage

Adds focused tests verifying that:

• an empty literal identity token does not select direct federation;
• clearing a previously valid literal token fails locally before any token exchange;
• an empty literal token does not mask a valid identity-token file.

The change is confined to the hand-maintained credential-resolution chain.