Killing the long-lived tokens in my CI, one exchange at a time

A static service token in GitHub Secrets is a breach with the timer already running. So I replace them with an OIDC exchange: every CI job proves who it is at runtime and gets a token that dies in minutes. The mechanism, the links, the config, and an honest list of what still holds one.