Under the hood
Remote settings can authenticate with a Workload Identity Federation bearer token when no API key or OAuth token exists.
Remote settings fetching now has a fallback credential path for Workload Identity Federation (WIF): when no API key or user OAuth token is available, it obtains a bearer token via getWIFTokenCache/getWIFCredentials and marks the request with profileBearer: true. A 401 with this credential triggers one forced refresh and retry; if the settings endpoint rejects the refreshed token too, a settingsBearerRejected latch stops further retries with that credential until the next sign-in or restart.