[StanleyLl0yd]

Authenticated source time, not forecast authorization

• New protected owner-only job gate with id-token: write granted at job scope; no DB credentials or writes.
• After two separate live source observations, request two different signed GitHub Actions OIDC tokens with custom aud values bound to the exact SHA-256 of authenticated OpenFoot response envelopes and independent live MatchTV calendar bytes. Verify RS256 issuer and current GitHub HTTPS JWKS, exact SHA/ref/repo ID/owner ID/run attempt/workflow/branch/environment/event and freshness. Never fetch signing keys from JWT-provided URLs.
• Pin PyJWT[crypto]==2.15.1, cryptography==50.0.2. Synthetic negative crypto/issuer/owner/time/cross-audience tests. Emit only SHA of JWTs and signed issuance timestamps in bounded read-only report.
• Same signing authority (GitHub), distinct publishers: not publisher-issued original-serving time; no trusted PG clock, no FORECAST/ABSTAIN or source rows exported, no 2025/26 access/public predictions. A5 remains OPEN until reviewed immutable before-kickoff capture.

Refs #304.