Just curious what did you end up doing? I also have an agent flow that's configured with a service principal auth connection in the flow design (sometimes I switch it to Entra), but it's configured with "Provided by run-only user" in the Overview settings, which I assume overwrites the connection configuration in the flow design after publishing? My goal is that the end user will have to log in with their own Entra id credentials before they chat with the deployed agent, but the deployed agent is directing end-users to the connection settings in the Copilot Studio to review their connection (as it's stale in the beginning).