Trust GitHub Actions alongside the Source issuer

Phase 4 — First shippable milestone.

Today
CI already exchanges real GitHub Actions tokens at /.sts on every same-repo run — but by swapping the trusted issuer, never running GitHub alongside our own. AUTH_ISSUER is a single String, while AUTH_AUDIENCE is already a list.

Do

• Trust both issuers at once.
• Pin subjects to a repository and ref. No organization-wide wildcards.
• Wire GitHub up as an Integration type end to end.

Done when
A workflow in an unrelated repository writes to a product using only its ambient OIDC token, with no stored secret.

Watch

• aws-actions/configure-aws-credentials will not work: it calls GetCallerIdentity after the exchange, which is unimplemented upstream (developmentseed/multistore#126). The SDKs' built-in web-identity credential providers do work. This is the way most people will first try it, so it needs saying in the docs.
• Config plumbing spans three environments (wrangler.toml production and staging, plus wrangler.preview.toml).

Reconcile with source-cooperative/source.coop#432 before starting — that epic covers the same ground from the source.coop side. One of the two should absorb the other.

See ADR-009.

Depends on source-cooperative/source.coop#546, source-cooperative/data.source.coop#221 and source-cooperative/data.source.coop#222.

Part of source-cooperative/source.coop#491.

Start by reading ADR-009 and reconciling this issue with source-cooperative/source.coop#432 before examining the configuration in wrangler.toml for production and staging and wrangler.preview.toml. Confirm the dependent issues are resolved, then trace the existing /.sts exchange and Integration handling. Done means both issuers are trusted with repository/ref-pinned subjects, GitHub works end to end without a stored secret, and the configure-aws-credentials limitation is documented.