Fix audit round-1 findings: README defaults, symbol count, release-signing pin, manifest name, release-create fallback

[MattJackson]

Summary

Re-validated the round-1 audit ledger against current origin/main (post-restructure: busbar-auth-oidc is now a same-repo sibling crate under auth-oidc/, no longer a busbarAI/crates/auth-oidc path dependency) and fixed everything that checked out as genuinely real.

• README role_claim default: documented as absent ("—"); the struct actually defaults it to "groups" via #[serde(default = "default_role_claim")]. Fixed the table.
• Missing config fields: jwks_min_refetch_secs (default 60) and jwks_ttl_secs (default 3600) are real OidcConfig fields, added to the README table.
• "five extern-C symbols" → six: the SDK's export_auth_plugin! actually emits busbar_abi, busbar_plugin_kind, busbar_open, busbar_call, busbar_free, busbar_close. Fixed both README.md and auth-oidc-plugin/src/lib.rs's doc comment, listing all six.
• Vacuous test assertion: assert!(!err.is_empty()) in auth-oidc-plugin/src/tests.rs only re-proved what expect_err already established. Strengthened to assert the message actually names the failed step ("OIDC discovery fetch failed").
• release.yml signing step checked out a mutable branch (BUSBAR_REF: 1.5.0-dev) in the same job that builds+runs busbar-plugin-pack and holds BUSBAR_SIGN_KEY + id-token: write. Pinned to that branch's tip SHA at time of fix, with a comment on what to verify before bumping it. Note: crates/auth-oidc is indeed absent at that SHA (a separately-tracked, out-of-scope upstream extraction issue), but it no longer matters — this repo's OIDC logic now lives in its own auth-oidc/ crate; the release build only needs crates/api, crates/plugin-sdk, crates/plugin-loader, crates/plugin-abi, and crates/plugin-pack, all of which are present at the pinned SHA (verified via the GitHub API).
• Packed manifest name disagreement: release.yml's signing step packed --name "busbar-auth-oidc", disagreeing with both the README's documented invocation and CI's own signoff (plugin-ci.yml's --name "${{ inputs.plugin_crate }}", fed busbar-auth-oidc-plugin from ci.yml). Since manifest.name is load-bearing for plugin-registry matching, this meant CI's signoff proved a different artifact identity than what actually ships. Corrected the outlier to busbar-auth-oidc-plugin (majority) and aligned the output tarball filename to match.
• gh release create ... || gh release view ... fallback swallowed any create failure (auth errors, --verify-tag rejection, --generate-notes errors), not just the intended "already exists" race. Narrowed it to only fall through when the failure output actually says "already exists"; anything else now fails the job.

Left alone (out of scope / already correct):

• The unsigned-release fallback (--allow-unsigned when BUSBAR_SIGN_KEY isn't provisioned) — documented product decision (TODO(release-keys)), not touched.
• The crates/auth-oidc extraction issue upstream — someone else is handling it; it's also no longer relevant to this repo's build now that the crate lives here.

Stale/incorrect in the original ledger

The pinned-audit's premise for the release-signing finding — "verify crates/auth-oidc exists at whatever SHA you pin to" — turned out to be moot: between the audit's pin and origin/main, the repo was restructured so busbar-auth-oidc's real logic moved into this repo's own auth-oidc/ crate (workspace member), and the plugin only depends on busbarAI/crates/{api,plugin-sdk,plugin-loader,plugin-abi,plugin-pack} now, not crates/auth-oidc. All of those are present at the pinned SHA, so the pin doesn't need to fall back to an older commit.

Test plan

• cargo fmt --check — clean
• cargo build --all-targets — succeeds (the ../../busbarAI/crates/* path deps resolve against the local busbarAI/busbarAI checkout)
• cargo clippy --all-targets -- -D warnings — clean
• cargo test — 38/38 tests pass (28 in auth-oidc, 8 unit + 2 e2e in auth-oidc-plugin), including the strengthened discovery-failure assertion
• python3 -c "import yaml; yaml.safe_load(...)" on release.yml — valid YAML