fix(github): support immutable OIDC subjects

[neriousy]

Summary

• derive the repository identity from GitHub’s signed repository claim instead of parsing the mutable sub format
• support legacy, immutable @id, and customized subject formats
• return a structured broker error when GitHub App token exchange fails
• preserve the original action error when GitHub clients are not initialized
• run the function claim tests in repository CI

Verification

• bun test in packages/function (5 passed)
• bun test test/cli/github-action.test.ts in packages/opencode (17 passed)
• bun typecheck in packages/opencode
• full workspace typecheck from the pre-push hook
• Prettier, Oxlint, and git diff --check

Fixes#37823

[0xjei]

lovely, thx @neriousy