fix(ci): remove OIDC from preflight job

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/drift-check.yml

@@ -20,7 +20,6 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
-      id-token: write
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       LIFECYCLE_PERFORMANCE_BUCKET: ${{ vars.LIFECYCLE_PERFORMANCE_BUCKET || '' }}

tests/test_drift_workflow_config.py

@@ -20,6 +20,8 @@ def test_drift_workflow_wires_pipeline_repo_and_lifecycle_env() -> None:
     assert "needs.preflight_backtests.result == 'skipped'" in workflow
     assert "head.repo.full_name == github.repository" in workflow
     assert "id-token: write" in workflow
+    preflight = workflow.split("  drift:", maxsplit=1)[0]
+    assert "id-token: write" not in preflight
     assert "uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@17278db4e7aef0007346d853eb308b6c1bd8c859" in workflow
     assert "strategy_domain: crypto" in workflow
     assert "caller_event_name: ${{ github.event_name }}" in workflow