fix(login): resolve the registration org consistently with the login policy (#12621)

# Which Problems Are Solved

When resolving the organization for a self-registration, the resource
owner was determined only from an explicitly requested org, falling back
to the default org. The login policy applied to the same request,
however, is resolved from the requested org, the user org, and only then
the default org. As a result the two could diverge — e.g. after the
login context had already resolved a user's organization — and a user
could be registered in a different organization than the one whose
settings were evaluated for the request.

# How the Problems Are Solved

`determineResourceOwner` now uses the same resolution order as the
policy lookup (requested org, then user org, then default org), so the
organization a user is registered in matches the one the request was
evaluated against.

# Additional Changes

Added a unit test covering the resolution order.

# Additional Context

Aligns login v1 registration org resolution with the behavior in login
v2.

Co-authored-by: Claude Opus 4.8 <[email protected]>

.github/workflows/lint_test_build.yml

@@ -55,6 +55,17 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Set SHAs for nx affected commands
         uses: nrwl/nx-set-shas@v4
+      # The Depot runner image points /etc/resolv.conf directly at public DNS (8.8.8.8),
+      # bypassing the systemd-resolved stub, so *.integration.localhost (synthesized by
+      # systemd-resolved) no longer resolves and all API integration tests hang.
+      # Route DNS back through the stub until the image is fixed or the tests stop
+      # depending on wildcard localhost DNS.
+      - name: Restore systemd-resolved stub for *.localhost resolution
+        run: |
+          set -ex
+          test -e /run/systemd/resolve/stub-resolv.conf
+          sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
+          getent hosts foo.integration.localhost
       - name: Lint, Test and Build
         env:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}