GitHub OIDC sub can include immutable org/repo IDs (repo:ORG@id/REPO@id) - match it in the IAM trust

Symptom: GitHub Actions -> AWS via OIDC fails at aws-actions/configure-aws-credentials with "Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity", even though the role trust policy StringLike on token.actions.githubusercontent.com:sub looks correct (repo:ORG/REPO:*) and the OIDC provider/audience are right. Cause: some orgs enable a customized OIDC subject claim that appends immutable database IDs, so the real sub is repo:ORG@<orgId>/REPO@<repoId>:ref:refs/heads/main, which the plain repo:ORG/REPO:* pattern does NOT match. Fix: decode the actual token in a debug step (curl $ACTIONS_ID_TOKEN_REQUEST_URL&audience=... , base64url-decode the JWT payload, read sub) then set the trust StringLike to the real value, e.g. repo:ORG@<orgId>/REPO@<repoId>:*. Note AWS refuses a trust policy for this provider that has no sub/job_workflow_ref condition (must not be scoped to all).