Add workload identity federation support to base-action (#1378)

* Add workload identity federation support to base-action

Move the workload identity module into base-action so the standalone
action can fetch and refresh the GitHub OIDC identity token itself, and
expose the same federation inputs as the outer action. Switch the
base-action test workflows from the anthropic_api_key secret to the
federation repo variables and grant them id-token: write.

* Verify MCP test tool invocation instead of init connection status

MCP servers can connect asynchronously, so the init event may report a
server as pending. Check that the server is registered at init, then
assert the test tool was actually called and returned its response.
Also pass the MCP config through claude_args --mcp-config, replacing the
removed mcp_config input.

.github/workflows/ci-all.yml

@@ -11,6 +11,9 @@ on:
 
 permissions:
   contents: read
+  # Lets the test workflows mint the GitHub OIDC token they exchange for a
+  # Claude API access token (workload identity federation). See docs/setup.md.
+  id-token: write
 
 jobs:
   ci:
@@ -18,20 +21,15 @@ jobs:
 
   test-base-action:
     uses: ./.github/workflows/test-base-action.yml
-    secrets: inherit # Required for ANTHROPIC_API_KEY
 
   test-custom-executables:
     uses: ./.github/workflows/test-custom-executables.yml
-    secrets: inherit
 
   test-mcp-servers:
     uses: ./.github/workflows/test-mcp-servers.yml
-    secrets: inherit
 
   test-settings:
     uses: ./.github/workflows/test-settings.yml
-    secrets: inherit
 
   test-structured-output:
     uses: ./.github/workflows/test-structured-output.yml
-    secrets: inherit