Assert webauthn request auth instead of last request

test_with_webauthn_enabled_failure checked the Authorization header on
@stub_fetcher.last_request, but the webauthn flow runs a real polling
thread that issues its own request concurrently. On Rubies without a GIL
the poll request can land last, so last_request was not the
webauthn_verification request and the assertion saw a nil header.

Look up the webauthn_verification request explicitly and assert on its
Authorization header, which the main thread always records. This is the
invariant the test means to check and it is no longer order dependent, so
the TruffleRuby pend that papered over the same race can go too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hsbt

test/rubygems/test_gem_commands_owner_command.rb

@@ -399,7 +399,6 @@ def test_with_webauthn_enabled_success
   end
 
   def test_with_webauthn_enabled_failure
-    pend "Flaky on TruffleRuby" if RUBY_ENGINE == "truffleruby"
     response_success = "Owner added successfully."
     server = Gem::MockTCPServer.new
     error = Gem::WebauthnVerificationError.new("Something went wrong")
@@ -417,7 +416,8 @@ def test_with_webauthn_enabled_failure
       end
     end
 
-    assert_match @stub_fetcher.last_request["Authorization"], Gem.configuration.rubygems_api_key
+    webauthn_verification_request = @stub_fetcher.requests.find {|req| req.path == "/api/v1/webauthn_verification" }
+    assert_match webauthn_verification_request["Authorization"], Gem.configuration.rubygems_api_key
     assert_match "You have enabled multi-factor authentication. Please visit the following URL " \
       "to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, " \
       "you can re-run the gem signin command with the `--otp [your_code]` option.", @stub_ui.output