fix(github): support immutable OIDC subjects

[neriousy]

Summary

• derive GitHub repository identity from the signed repository OIDC claim instead of parsing sub
• support legacy, immutable @id, and customized subject formats
• return a structured broker error when GitHub App token exchange fails
• add focused claim tests to the V2 unit-test matrix

This is the V2 companion to #44776. The legacy GitHub Action handler is not present on V2, so this PR contains only the shared broker fix and tests.

Verification

• bun test in packages/function (5 passed)
• Turbo dry run confirms @opencode-ai/function#test executes bun test
• Prettier, Oxlint (0 errors), and git diff --check

Related to #37823