Add OIDC trust-policy evidence gates

[tick25108-cpu]

Fixes #383.

This updates secrets-management so OIDC is reviewed as a cloud-side trust-policy control, not just as the absence of static credentials.

What changed:

• Adds OIDC trust-policy evidence checks for issuer, audience, subject/context, environment binding, reusable workflow claims, token lifetime, and fork/untrusted workflow boundaries.
• Clarifies that GitHub Actions id-token: write is not itself a leaked secret.
• Adds a federated/OIDC role evidence table to the output template.
• Adds prompt-injection safety guidance for workflow and trust-policy metadata.
• Adds GitHub/AWS OIDC references.

Validation:

• git diff --check
• confirmed Markdown fence balance
• confirmed markers for id-token: write, token.actions.githubusercontent.com:aud, token.actions.githubusercontent.com:sub, job_workflow_ref, and environment protection evidence are present

Submitting this as an Improver contribution. Payment details can be handled privately after maintainer acceptance.