Short-lived OIDC for CI: kill every long-lived GitHub Actions token

GitHub OIDC to AWS/GCP/Azure federated credentials killed the need for long-lived PATs in CI. Most orgs still have PATs in use in 2026. Short-lived OIDC is the one-day win. Narrative arc The PAT failu