Diagnose npm OIDC failures without publishing

[gonzaloriestra]

WHY are these changes introduced?

Snapit receives 404: OIDC token exchange error - package not found, while a manual nightly from the same commit and actor publishes successfully. Existing logs do not expose the npm identity claims needed to explain the difference.

WHAT is this pull request doing?

Record the public signing-key ID, the identity fields used to match the trusted publisher, and the event type, then test the token exchange directly in the Snapit and nightly jobs. The signed GitHub token is masked, and registry response bodies are discarded without reading them. Actor IDs, enterprise details, and token timestamps are omitted. Diagnostic failures do not block publishing.

Add /snapit-oidc and a manual diagnostics_only input so the comparison can run without publishing packages or posting comments.

Validated YAML parsing and simulated successful/rejected exchanges, including checks that credentials and unlisted claims are not logged.

Post-release steps

Compare a /snapit-oidc run with a manual run using diagnostics_only: true on main. Remove the temporary diagnostics after identifying the rejection.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add