The GitHub Actions OIDC Mistake That Backdoors Your AWS

One missing condition in your IAM trust policy exposes every role to any public GitHub repository. I found this in a live audit. Here is the one-line fix.