[viztor]

Replaces the stored OpenCode access key the live-gateway e2e used with the
runner's own OIDC identity: GitHub mints a short-lived JWT for
https://opencode.ai/console, OpenCode Console exchanges it for an access token,
and only that token reaches pnpm run test:e2e. Nothing long-lived is stored in
the repository or in Actions secrets any more.

• permissions: id-token: write + contents: read on the e2e job only.
• A fork or Dependabot pull request is issued neither an OIDC endpoint nor
  secrets, so the sign-in step exits with a notice and the suite keeps its
  existing keyless behaviour: the endpoints are still checked, the credentialed
  cases skip.
• One exchanged token serves both planes; it is armed under the two names the
  suite already reads (OPENCODE_API_KEY, OPENCODE_GO_API_KEY).
• The client id identifies the Console CI token. It is public by design — the
  exchange binds it to the audience and the GitHub OIDC subject, so the id alone
  grants nothing.

Verified locally: test/freshness-scope.test.ts, test/vendor-version.test.ts
and test/node-engine.test.ts pass. The proof of the exchange is this pull
request's own e2e · live gateway run.