Document and add to skill for GitHub OIDC changes

[nealrichardson]

See https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/

Repos created on/after 2026-07-15 use immutable subject claims by default (older repos can opt in).

The gh invocation to retrieve this is:

# From within a local clone of the repository:
gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
  --jq '"\(.owner.login)@\(.owner.id)/\(.name)@\(.id)"'

# Or, for any repository by name:
gh api "repos/$ORG/$REPO" \
  --jq '"\(.owner.login)@\(.owner.id)/\(.name)@\(.id)"'

We should document this in the readme, and in the skill, offer to help set up trusted publishing on the repo. Use posit-cli, it can posit connect login <server_url> and then use posit connect api ... to set the trusted publishing repo, derived using gh from the current repo as noted above. https://docs.posit.co/connect/api/#post-/v1/content/-guid-/trusted-publishers describes the POST request needed to set it up.