Replace fake SAP engine in CI with self-hosted SAP runner

[HappyDevs1]

CI currently runs against a fake/mocked SAP engine. We have a self-hosted SAP runner deployed now, so let's switch CI over to use it for more realistic test coverage.

Since this runner talks to a real SAP system, we need to think through security as part of the migration — credential handling/secrets storage, network exposure of the runner, and access scoping for CI jobs.

Todo

• Point CI at the self-hosted SAP runner instead of the fake engine
• Review how credentials/secrets are passed to the runner from CI
• Confirm network access to the runner is scoped appropriately
• Update docs/CI config to reflect the change