Real-SAP E2E: run sap_e2e against a live SAP system via a self-hosted runner

[AminChirazi]

Tier 3 of the SAP testing ladder. Tiers 1–2 are live in CI since #30/#31: the in-memory fake engine proves the pipeline on every platform, and the scripting simulator proves the production COM engine (GetActiveObject, IDispatch late binding, VARIANT marshaling, FindById error paths) on stock windows-latest runners. What remains unverified is SAP's own behavior: real control types and tree shapes, sapgui/user_scripting handshakes, timing, multi-window dialogs, connection opening via SAP Logon.

The test itself already exists — crates/flowproof-cli/tests/sap_e2e.rs (windows-gated, FLOWPROOF_E2E_SAP=1) records and replays a navigation-only flow (Go to /nSESSION_MANAGER, surface assert; touches no business data). This issue is about giving it somewhere to run.

Infrastructure needed (org side)

• An SAP dev/trial system it may talk to — never production. Candidates: an existing internal dev landscape (the datamaker-sap-cli team may already have one), the free ABAP Platform Trial in Docker, or an SAP CAL appliance.
• One Windows VM with SAP GUI for Windows installed, SAP Logon configured for that system, scripting enabled (sapgui/user_scripting = TRUE in RZ11, client-side scripting allowed), and an auto-logged-in session or a logon step in the workflow.
• The VM registered as a self-hosted GitHub runner with a sap label.

Repo work (once infra exists)

• A sap-e2e.yml workflow: workflow_dispatch + nightly schedule, runs-on: [self-hosted, sap], runs cargo test -p flowproof-cli --test sap_e2e with FLOWPROOF_E2E_SAP=1; connection/credentials via repo secrets and ${VAR} indirection (values must never enter traces or logs — the engine's secret handling already guarantees the former).
• Session bootstrap/reset around the test (attach or open connection; recover from unexpected dialogs).
• Possibly extend sap_e2e with a data-free transaction walk once the basic attach path is proven.

Security notes

• Self-hosted runners execute workflow code: restrict the runner to this repo, do not enable it for fork PRs, and keep the VM network-limited to the SAP dev system.
• The E2E must stay read-only/navigation-only unless pointed at a disposable client.

Until this runs, the honest status line is: the COM wire protocol is proven end to end, SAP's side of the conversation is not.