security(replay): claim verified OIDC use before GitHub token creation

[seonghobae]

Completed protected-main invariant

The replay-before-token-mint defect is now protected-main truth.

• protected main: 933471b954512710bb9635f18f45fe8f323adcff;
• merged implementation: PR fix(security): claim verified OIDC replay before token mint #270, exact reviewed head 0e7bd32d0fbc7e91972d5feb73bd8fe73799b16a, merge commit 933471b954512710bb9635f18f45fe8f323adcff;
• protected-main CI run 31787748349 / verify job 94727390148: terminal success on that exact protected SHA, including exact checkout, pinned package-manager verification, install, and full release verify;
• protected source contains test/replay-before-token-mint.test.ts with a real RS256-signed OIDC fixture proving a verified replay returns 401 ERR_AUTH_REPLAY and produces zero POSTs to /app/installations/{id}/access_tokens;
• the accepted-first-use regression requires exact ordering replay-claim → installation-lookup → token-mint:POST and the protected worker exposes the successful path as single-use replay protection.

The implemented ordering is now:

distributed rate limit → bounded workflow prefilter → cryptographic OIDC verification → target-repository authorization → atomic distributed replay claim → GitHub App installation-token mint → response.

Unverified payload claims do not reserve replay state. Missing replay binding/verified claims and replay-service failure remain fail-closed before credential delivery.

Canonical architecture/documentation convergence remains tracked by #71/#82/#84 and does not reopen this already-integrated product/security defect. No release, deployment, outbound-license, production KPI, or acquisition-readiness claim is implied by closing this issue.

Related: #270, #273, #71, #82, #84.

[seonghobae]

Implementation is now in Draft PR #83, stacked on #71 to avoid racing the same credential-exchange source before the architecture branch integrates. Test-only head ed1e7c529712028c4f6e5c5bf928fb07bba48a18 introduced a real RS256-signed replay regression requiring zero GitHub access-token mint POSTs on replay. Current #83 head 5acd2f0f3c69a9e80f3878ab9359dd1829c061b1 moves the replay claim into the core after cryptographic OIDC verification + target-repository authorization and before createInstallationToken(), requires the replay Durable Object binding in the production wrapper before core execution, and adds a first-use ordering regression requiring replay_claim before token_mint. Current CI/reviewer runs are still pending/queued, and the feature-base stack has no central Security Scan trigger, so no GREEN/merge claim is made. After #71 integrates, #83 must be refreshed onto the live protected base, exact-head full CI/security/coverage/review re-run, and architecture/UML/gap-audit ordering updated before #81 can close.