Bazel remote cache builds stop failing at token expiry

The Bazel credential helper refreshes the user’s access token when it is within a 60-second safety margin of expiry and reports expires brought forward by that same margin so Bazel re-invokes the helper ahead of the boundary. Project tokens are passed through unchanged, account tokens are passed through unchanged, and a failed refresh falls back to the still-valid token. Long Bazel builds against Tuist/Kura remote caches no longer hit intermediate bursts of UNAUTHENTICATED near the access token boundary.