fix(cache): authorize a warm claim by its run, not by its job name

[rldyourmnd]

19 warm cache claims refused against 7 bound, in one live hour. Every one of those jobs ran uncached — the slow path warm capacity exists to remove.

A promoted warm container keeps its provider instance name while the one-job JIT runner takes GitHub's runner name, so the broker proves the pair through the queue journal before handing over credentials. It did that with BindRunning, which must resolve exactly one intent because it writes to it, and which separates a run's sibling jobs by comparing the journal's display name against GITHUB_JOB.

Those agree for a bare job and a reusable-workflow prefix, and disagree for every matrix job. From the live journal, taken while writing this:

Analyze (python)              GITHUB_JOB=analyze
Analyze (javascript-typescript)
Backend pytest shard 4/4
Backend (pytest, DB-backed)
Mobile test (flutter test)
Image plan (inventory + build groups)

The fix. Authorization does not need to identify the job. The credential is scoped to a repository, so the question is whether this scale set is serving that repository's run — and (scale set, owner, repository, workflow run id) is a tighter key than any job-name comparison. AuthorizeRunning asks exactly that and writes nothing. The exact intent is still bound by BindRunning and its asynchronous retry once GitHub reports the job started.

An intent admitted before JobAvailable carries no run id yet, and BindRunning already treats that as compatible, so authorization does too — refusing it would deny warm capacity the head-of-queue case it is for.

It is not a weakening. TestWarmClaimForAnotherRepositoryIsStillRefused: a warm runner presenting a repository this scale set holds no active work for is refused, and its one-job token is not consumed.

The refusal is now diagnosable. It was the only path in the handler that logged no identity at all — the one failure costing every warm runner its cache was the one that could not be read from its own log. It now carries instance, runner, repository, run, job, pool and the bind error.

TestWarmClaimIsAuthorizedForAMatrixJobDisplayName reproduces the live shape with three sibling Analyze (…) intents; it asserts the claim is authorized and that queue running correlation deferred is still logged — which is the proof that the old exact-resolution path genuinely could not resolve this fixture.

.95 because CONTROLLER_VERSION reads derivative_version and stamps gha-cache-broker with it; a broker change shipping under the previous version leaves the live identity unable to say which code is running.