Keep the cloud e2e worker off the production PostHog project (#2394)

The e2e worker inherited the production PostHog key from wrangler.jsonc vars, so server-side flag gates evaluated live production flags for synthetic e2e users. Since google-oauth-review was widened in production, first-party-oauth fails on every run because Google is now listed. Clear the key in the e2e boot so each gate takes its no-flag-service path.

Author: RhysSullivan

e2e/scenarios/first-party-oauth.test.ts

@@ -187,9 +187,10 @@ scenario(
         });
       });
 
-      // The Executor-owned Google app is withheld from every listing: it is no
-      // longer offered for new connections, so connecting Google means bringing
-      // your own OAuth app. It stays fully resolvable by slug, which the
+      // The Executor-owned Google app is listed only for users the
+      // `google-oauth-review` flag admits, and withheld whenever no flag service
+      // answers. The e2e stack configures no PostHog project (cloud.boot.ts),
+      // so here it is withheld. It stays fully resolvable by slug, which the
       // `oauth.start` cases below exercise — that is the guarantee for everyone
       // already connected through it. Its reviewed consumer scope bundle, no
       // longer introspectable from here, is asserted on the config it is built

e2e/setup/cloud.boot.ts

@@ -128,6 +128,13 @@ export const bootCloud = async (options: CloudBootOptions): Promise<CloudBooted>
     // scope policy, and authorization URL construction end to end.
     FIRST_PARTY_GOOGLE_CLIENT_ID: "e2e-first-party-google",
     FIRST_PARTY_GOOGLE_CLIENT_SECRET: "e2e-first-party-google-secret",
+    // No PostHog project. wrangler.jsonc ships the production project key as a
+    // var, and the worker evaluates server-side feature flags with it (the
+    // Google OAuth listing, the enterprise-managed auth rollout). Inheriting it
+    // made e2e outcomes follow whatever those flags are set to in production
+    // and sent every synthetic e2e user to the production project. With no
+    // key, each gate takes its documented no-flag-service path.
+    VITE_PUBLIC_POSTHOG_KEY: "",
     // Shrink the per-org hourly execution cap (prod default 1000) to a number
     // the rate-limit-backstop scenario can actually exhaust with real
     // executions — but see execution-limits.ts: it must stay above every other