Add workload identity federation support to base-action (#1378)

* Add workload identity federation support to base-action

Move the workload identity module into base-action so the standalone
action can fetch and refresh the GitHub OIDC identity token itself, and
expose the same federation inputs as the outer action. Switch the
base-action test workflows from the anthropic_api_key secret to the
federation repo variables and grant them id-token: write.

* Verify MCP test tool invocation instead of init connection status

MCP servers can connect asynchronously, so the init event may report a
server as pending. Check that the server is registered at init, then
assert the test tool was actually called and returned its response.
Also pass the MCP config through claude_args --mcp-config, replacing the
removed mcp_config input.

base-action/src/index.ts

@@ -7,9 +7,16 @@ import { setupClaudeCodeSettings } from "./setup-claude-code-settings";
 import { validateEnvironmentVariables } from "./validate-env";
 import { installPlugins } from "./install-plugins";
 import { setExecutionFileOutputIfPresent } from "./execution-file";
+import { setupWorkloadIdentity } from "./workload-identity";
+import type { WorkloadIdentityHandle } from "./workload-identity";
 
 async function run() {
+  let workloadIdentity: WorkloadIdentityHandle | undefined;
   try {
+    // When workload identity federation is configured, fetch the GitHub OIDC
+    // identity token and expose it to the CLI before validating auth env vars.
+    workloadIdentity = await setupWorkloadIdentity();
+
     validateEnvironmentVariables();
 
     // The composite action's "Install Claude Code" step writes the binary to
@@ -67,6 +74,9 @@ async function run() {
     core.setFailed(`Action failed with error: ${error}`);
     core.setOutput("conclusion", "failure");
     process.exit(1);
+  } finally {
+    // Stop refreshing the workload identity token file so the process can exit
+    workloadIdentity?.stop();
   }
 }