WIF refresh can recreate credentials after action cleanup

## Summary

An in-flight workload identity federation refresh can recreate credential material after the action has started cleanup.

## Reproduction

1. Configure workload identity federation.
2. Let a scheduled refresh enter the asynchronous OIDC token request.
3. Finish the action while that request is still pending.
4. Cleanup removes RUNNER_TEMP/claude-workload-identity.
5. The pending refresh resolves.

## Expected behavior

After cleanup starts, no identity token or exchanged-credential cache should be recreated.

## Actual behavior

The pending refresh can write a new identity token and cache directory after stop() has removed them, leaving secret-bearing files in the runner's temporary directory.

## Relevant code

- base-action/src/workload-identity.ts:147-153
- base-action/src/workload-identity.ts:192-199

PR #1620 adds a stopped-state guard and regression coverage.