Namespace the credential subject by verified issuer

Phase 3 — Roles and the proxy.

Today
The minted credential records who the caller is but not who vouched for them, so every issuer's subjects share one flat namespace. That subject is also part of the proxy's cache key, so a collision affects cached authorization results too.

Do
Rewrite the principal into an issuer-qualified form before it reaches the Source API, derived from the verified iss claim.

Done when
Two issuers using the same subject string resolve to different accounts and do not share a cache entry.

Watch
Derive the namespace from the verified claim, not from Role config — one Role may trust several issuers, which would collapse them back into one namespace.

Why it blocks GitHub
GitHub counts as a second issuer. This must land before GitHub is trusted, not only before user-registered issuers.

Depends on source-cooperative/source.coop#543.

Part of source-cooperative/source.coop#491.

Start by tracing how the verified iss claim and subject reach the Source API and how the proxy builds its cache key; review source-cooperative/source.coop#543 first. Done means two issuers with the same subject resolve to different accounts and never share a cache entry, including the GitHub issuer path.