ci: mint PlanetScale credentials over OIDC instead of storing tokens - #2553

🟢 Confidence 10/10 · safe to merge. Delta since the last review is two docs files, which are out of scope; the OIDC exchange itself is unexercised until the post-merge deploy and dispatched drill.
_{no findings · tests not needed · risk high}

The only files changed since the last review are two docs pages recording the new PlanetScale OIDC trusts; no workflow or code changed. Nothing to review, and everything the docs claim matches the workflows at the head.

Before merge

• Env var · Add PLANETSCALE_OIDC_TRUST_ID to the repository's CI variables · .github/workflows/backup-restore-test.yml:68
• Manual · Watch the first deploy-prd.yml run for us and eu, then dispatch backup-restore-test.yml
• Manual · After both are green, delete PLANETSCALE_API_TOKEN_ID / PLANETSCALE_API_TOKEN from Infisical prod and prod-eu and revoke alchemy-deploy

_{f4bd8e8 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}