fix(core): compose nested withAuth by merging from enclosing scope

`runWithConfig` was building its merged config from the process-wide
global, not from the enclosing ALS scope. That broke the documented
`auth.withAuth(...)` + `auth.withPublicToken(...)` composition: the
inner `withAuth` (called by withPublicToken internally) silently
dropped the outer scope's baseURL/branch overrides.

Read from the active scope first, fall back to the global, then merge
in the new config. Pre-existing concurrency-safety (parallel scopes)
holds. New test covers the nested-composition case.

Author: ericallam

packages/core/src/v3/apiClientManager/index.ts

@@ -120,7 +120,8 @@ export class APIClientManagerAPI {
     config: ApiClientConfiguration,
     fn: R
   ): Promise<ReturnType<R>> {
-    const merged = this.resolveApiClientConfig({ ...this.#getConfig(), ...config });
+    const current = sdkScope.getStore()?.apiClientConfig ?? this.#getConfig();
+    const merged = this.resolveApiClientConfig({ ...current, ...config });
 
     if (sdkScope.hasStorage()) {
       return sdkScope.withScope({ apiClientConfig: merged, inheritContext: true }, fn);

packages/trigger-sdk/src/v3/triggerClient.test.ts

@@ -241,6 +241,22 @@ describe("auth.withAuth", () => {
     ).toBe("https://override.example.com");
   });
 
+  it("composes nested withAuth: outer-scope fields flow into the inner scope", async () => {
+    vi.stubEnv("TRIGGER_SECRET_KEY", "tr_env_token");
+
+    let observedBaseURL: string | undefined;
+    let observedAuth: string | undefined;
+    await auth.withAuth({ baseURL: "https://outer.example.com" }, async () => {
+      await auth.withAuth({ accessToken: "tr_inner_token" }, async () => {
+        observedBaseURL = apiClientManager.baseURL;
+        observedAuth = apiClientManager.accessToken;
+      });
+    });
+
+    expect(observedBaseURL).toBe("https://outer.example.com");
+    expect(observedAuth).toBe("tr_inner_token");
+  });
+
   it("does not stomp on a parallel withAuth call with a different config", async () => {
     configure({ accessToken: "tr_global" });