fix(github): support immutable OIDC subjects

[opencode-agent]

Summary

• derive the repository identity from GitHub’s signed repository OIDC claim instead of parsing the mutable shape of sub
• cover both legacy and immutable subject formats with focused claim-parsing tests
• preserve the original exchange failure when the API returns non-JSON and avoid attempting to comment before GitHub clients are initialized

Checks

• bun test in packages/function (4 passing)
• bun test test/cli/github-action.test.ts in packages/opencode (17 passing)
• Prettier checks for all changed files
• Oxlint (0 errors)

Fixes#37823

Requested by: @rekram1-node (Aiden Cline via Slack)

[chAwater]

Hi, @rekram1-node

• The PR fix: handle GitHub OIDC format and error handling #37889 also fix the same issue
  • Could you please take a look?
  • If you decide to merge this PR instead, then close it

[0xjei]

bump

[neriousy]

Thanks @rekram1-node for the repository-claim implementation and focused tests. This is superseded by #44776 on dev and #44778 on v2, which carry the same approach with the final broker and action error handling. Closing to consolidate the work.