test(e2e): fix _agent_api_url regression in suite23; isolate suite26 credential tests

- suite23: build the respond URL via runtime.client._agent_url() (the removed
  runtime._agent_api_url helper).
- suite26: function-scoped runtime fixture so each credential test re-registers
  the worker TaskDef (with overwrite), making TaskDef.runtimeMetadata reflect
  the test's own code path instead of a value left by a prior test in the module.
  Verified via fail-first mutation: removing the registration stamping now fails
  both credential tests together (previously the module-scoped runtime masked it).

Author: v1r3n

e2e/test_suite23_from_instance_and_event_hitl.py

@@ -200,7 +200,7 @@ def test_event_without_execution_id_raises(self):
 
     def test_respond_url_matches_server_wire_format(self, runtime):
         """The respond URL is /api/agent/{executionId}/respond (Java parity)."""
-        url = runtime._agent_api_url(f"/{self.SUB_EXEC}/respond")
+        url = runtime.client._agent_url(f"/{self.SUB_EXEC}/respond")
         assert url.endswith(f"/agent/{self.SUB_EXEC}/respond"), (
             f"respond must POST to /api/agent/{{id}}/respond; got {url!r}."
         )

e2e/test_suite26_worker_credentials.py

@@ -39,6 +39,21 @@
 _BASE = _API.replace("/api", "")
 
 
+@pytest.fixture()
+def runtime():
+    """Function-scoped runtime (overrides the module-scoped conftest fixture).
+
+    Each test gets a fresh runtime so it re-registers the worker TaskDef (with
+    overwrite) — making TaskDef.runtimeMetadata reflect *this* test's code path
+    rather than a value left by a prior test in the module (the module-scoped
+    runtime caches registered tool names and would otherwise skip re-registration,
+    letting a stale/server-recompiled value mask a regression)."""
+    from conductor.ai.agents import AgentRuntime
+
+    with AgentRuntime() as rt:
+        yield rt
+
+
 # ── Tool: reports whether the declared secret was injected ───────────────