ci: source OIDC identity from repository vars

[Pigbibi]

Summary

• source GCP_PROJECT_ID, GCP_WORKLOAD_IDENTITY_PROVIDER, and GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT from repository variables
• fail closed before checkout, authentication, deployment, or other remote steps when any required variable is empty
• update the existing Runtime and Watchdog workflow contract tests

The three repository variable names were verified as present before this PR. No variable values are included here.

Scope

Workflow wiring and focused contract tests only. No runtime, permissions, triggers, deployment parameters, business logic, or dependency changes.

Validation

• python3 -m pytest -q tests/test_watchdog_workflow.py (8 passed)
• bash tests/test_runtime_workflow_shared_config.sh
• YAML parse plus local empty/configured preflight simulation
• actionlint .github/workflows/main.yml .github/workflows/watchdog.yml
• git diff HEAD^ --check

Risk

If any required repository variable becomes empty, both workflows now stop before remote actions instead of using a deployment-specific fallback. The required variable names are currently present.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The prior blocker is demonstrably fixed by the cumulative diff. Both .github/workflows/main.yml and .github/workflows/watchdog.yml now fail in a pre-authentication preflight step unless the three repository variables GCP_PROJECT_ID, GCP_WORKLOAD_IDENTITY_PROVIDER, and GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT hash to the single hard-coded EXPECTED_OIDC_IDENTITY_SHA256 value stored in version control. That means changing repository variables alone can no longer silently retarget OIDC or deployment identity; any approved identity change now requires a PR that updates the reviewed workflow constant. The added tests in tests/test_runtime_workflow_shared_config.sh and tests/test_watchdog_workflow.py also treat that fixed digest gate, its ordering before checkout/auth, and its fail-closed behavior as contract evidence. No current finding remains valid, and there is no contract conflict because there are no current blocking findings.

---

Review by Codex PR Review bot • PR