0.9.1-beta.26179.1 cannot find identity

**Describe the bug**
I updated a working workflow 0.9.1-beta.25379.1 from to 0.9.1-beta.26179.1. Signing that had previously worked failed.

**Expected behavior**
Signing to succeed

**Actual behavior**
Signing fails with

```
trce: Sign.SignatureProviders.KeyVault.KeyVaultService[0]
Fetching certificate from Azure Key Vault.
fail: Azure.Identity[10]
False MSAL 4.83.1.0 MSAL.NetCore .NET 8.0.25 Microsoft Windows 10.0.26100 [2026-05-01 10:00:57Z - b64cfd1d-f3e8-449e-abc3-3a70f325b0fd] Error message: [Managed Identity] Authentication unavailable. Either the requested identity has not been assigned to this resource, or other errors could be present. Ensure the identity is correctly assigned and check the inner exception for more details. For more information, visit https://aka.ms/msal-managed-identity.
Status: BadRequest
Content:
{"error":"invalid_request","error_description":"Identity not found"}

Headers:
Server: IMDS/150.870.65.2020
x-ms-request-id: a0b616f1-ee7e-4d1f-8cce-db5d8df16fff
Date: Fri, 01 May 2026 10:00:56 GMT

[Managed Identity] Error Code: invalid_request Error Description: Identity not found Http status code: BadRequest
fail: Azure.Identity[10]
False MSAL 4.83.1.0 MSAL.NetCore .NET 8.0.25 Microsoft Windows 10.0.26100 [2026-05-01 10:00:57Z - b64cfd1d-f3e8-449e-abc3-3a70f325b0fd] Exception type: Microsoft.Identity.Client.MsalServiceException
, ErrorCode: managed_identity_request_failed
HTTP StatusCode 0
CorrelationId b64cfd1d-f3e8-449e-abc3-3a70f325b0fd
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at Microsoft.Identity.Client.ManagedIdentity.ImdsManagedIdentitySource.HandleResponseAsync(AcquireTokenForManagedIdentityParameters parameters, HttpResponse response, CancellationToken cancellationToken)
at Microsoft.Identity.Client.ManagedIdentity.AbstractManagedIdentity.AuthenticateAsync(AcquireTokenForManagedIdentityParameters parameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.ManagedIdentity.ManagedIdentityClient.SendTokenRequestForManagedIdentityAsync(RequestContext requestContext, AcquireTokenForManagedIdentityParameters parameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.SendTokenRequestForManagedIdentityAsync(ILoggerAdapter logger, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

fail: Sign.Core.ISigner[0]
AKV10046: Unable to resolve the key used for signature validation. EncodedJwtHeader: '***'.
Status: 401 (Unauthorized)
ErrorCode: Unauthorized

Content:
{"error":{"code":"Unauthorized","message":"AKV10046: Unable to resolve the key used for signature validation. EncodedJwtHeader: '***'."}}

Headers:
Cache-Control: no-cache
Pragma: no-cache
x-ms-keyvault-region: westus2
x-ms-client-request-id: 57f59fc7-3012-4cd0-87df-c178a9ade81b
x-ms-request-id: f3aca4d3-96d6-4c79-90c6-dd6e33d6aa22
x-ms-keyvault-service-version: 1.9.3070.2
x-ms-keyvault-network-info: conn_type=Ipv4;addr=52.225.25.50;act_addr_fam=InterNetwork;
X-Content-Type-Options: REDACTED
Strict-Transport-Security: REDACTED
WWW-Authenticate: ***"https://login.microsoftonline.com/***", resource="https://vault.azure.net/"
Date: Fri, 01 May 2026 10:00:58 GMT
Content-Type: application/json; charset=utf-8
Expires: -1
Content-Length: 266

Azure.RequestFailedException: AKV10046: Unable to resolve the key used for signature validation. EncodedJwtHeader: '***'.
Status: 401 (Unauthorized)
ErrorCode: Unauthorized

Content:
{"error":{"code":"Unauthorized","message":"AKV10046: Unable to resolve the key used for signature validation. EncodedJwtHeader: '***'."}}

Headers:
Cache-Control: no-cache
Pragma: no-cache
x-ms-keyvault-region: westus2
x-ms-client-request-id: 57f59fc7-3012-4cd0-87df-c178a9ade81b
x-ms-request-id: f3aca4d3-96d6-4c79-90c6-dd6e33d6aa22
x-ms-keyvault-service-version: 1.9.3070.2
x-ms-keyvault-network-info: conn_type=Ipv4;addr=52.225.25.50;act_addr_fam=InterNetwork;
X-Content-Type-Options: REDACTED
Strict-Transport-Security: REDACTED
WWW-Authenticate: ***"https://login.microsoftonline.com/***", resource="https://vault.azure.net/"
Date: Fri, 01 May 2026 10:00:58 GMT
Content-Type: application/json; charset=utf-8
Expires: -1
Content-Length: 266

at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
at Azure.Security.KeyVault.Certificates.CertificateClient.GetCertificateAsync(String certificateName, CancellationToken cancellationToken)
at Sign.SignatureProviders.KeyVault.KeyVaultService.GetCertificateAsync(CancellationToken cancellationToken) in /_/src/Sign.SignatureProviders.KeyVault/KeyVaultService.cs:line 66
at Sign.Core.Signer.SignAsync(IReadOnlyList`1 inputFiles, String outputFile, FileInfo fileList, Boolean recurseContainers, DirectoryInfo baseDirectory, String applicationName, String publisherName, String description, Uri descriptionUrl, Uri timestampUrl, Int32 maxConcurrency, HashAlgorithmName fileHashAlgorithm, HashAlgorithmName timestampHashAlgorithm) in /_/src/Sign.Core/Signer.cs:line 79
Error: Process completed with exit code 1.
```

**Additional context**
- Workflow authenticates to Azure Key Vault via ODIC, which succeeds
```
C:\Windows\system32\cmd.exe /D /S /C ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" cloud set -n azurecloud"
Done setting cloud: "azurecloud"
Federated token details:
issuer - https://token.actions.githubusercontent.com/
subject claim - repo:blowdart/idunno.Security.Ssrf:environment:release
audience - api://AzureADTokenExchange
job_workflow_ref - blowdart/idunno.Security.Ssrf/.github/workflows/release.yml@refs/tags/v5.1.0
Attempting Azure CLI login by using OIDC...
Subscription is set successfully.
Azure CLI login succeeds by using OIDC.
```
- Reverting to 0.9.1-beta.25379.1 results in successful signing with no other changes.