RFC 8693 token exchange

Exchange a GitHub Actions OIDC JWT for a 15-min run402 session JWT. NO Authorization header — the OIDC JWT in subject_token is the sole authentication. JSON only (NOT form-encoded). Body cap 12 KiB; subject_token cap 8192 bytes (rejected before parse). Verification order: decode iss from PAYLOAD (NOT header), look up issuer in trusted_oidc_issuers (unknown → 401 without external JWKS fetch), jose.jwtVerify with algorithms:["RS256"] pinned and clockTolerance:30s, exact-string aud post-check, required GitHub claims as non-empty strings, candidate fetch via partial index, subject-pattern matching with deterministic precedence (exact > longer-prefix), event_name ∈ allowed_events, repository_id strong-bind if non-NULL, atomic conditional UPDATE (closes revoke-during-exchange race). The session JWT's exp = min(iat+900, binding.expires_at_unix) — expires_in may be < 900 if the binding expires sooner. Authority disclosed by the wallet-signed delegation: deployed function code runs with the project's runtime authority + database authority (migrations, RLS/expose changes); revocation does NOT undo deployed code.