feat(run-environment): mint CircleCI OIDC tokens for upload auth

[fargito]

Mint an OIDC token so CircleCI jobs need no CODSPEED_TOKEN secret.

The token CircleCI exposes in CIRCLE_OIDC_TOKEN and CIRCLE_OIDC_TOKEN_V2 cannot be used: its
audience is fixed to the id of the CircleCI organization, while CodSpeed requires its own. Only
the circleci CLI can request a custom audience — CircleCI publishes no endpoint for it, unlike
the ACTIONS_ID_TOKEN_REQUEST_URL GitHub Actions provides — so the runner shells out to
circleci run oidc get, once per upload, as a token expires an hour after it is minted.

Whether a job can mint at all is settled by minting a token and throwing it away, before the
benchmarks run. A CLI can be installed and still predate run oidc get, so probing for the binary
would pass and the mint would fail once the benchmarks had run for nothing.

Two cases keep needing a static token, and both are refused upfront: pull requests opened from a
fork, whose token names the fork, and jobs that cannot mint at all. A third is only visible when
the upload is refused: a pipeline triggered by a custom webhook gets a token naming no repository.

The error messages link integrations/ci/circleci/configuration, anchors #authentication and
#oidc-recommended. That page does not exist yet, and owes the three cases above.

Stacked on #473. Server-side support is not released yet, so a real CircleCI job cannot be
verified end to end.

Closes COD-3257

[greptile-apps]

Greptile Summary

Adds native CircleCI OIDC authentication for benchmark uploads.

• Mints a custom-audience token during configuration to detect unsupported jobs before benchmarks run.
• Refreshes the token immediately before each upload.
• Retains static-token authentication for forked pull requests and other unsupported pipeline types.
• Improves CircleCI-specific authentication guidance for rejected uploads.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported compatibility-probe defect is fixed because missing or outdated CircleCI CLIs now fail during provider initialization, before benchmark execution, while preserving the CLI's diagnostic output.

Important Files Changed

Filename	Overview
src/run_environment/circleci/oidc.rs	Adds custom-audience token minting with exit-status, UTF-8, empty-output, and stderr handling while keeping token contents out of logs.
src/run_environment/circleci/provider.rs	Replaces the inadequate CLI version probe with an actual preflight mint and refreshes authentication before every upload.
src/upload/uploader.rs	Adds CircleCI-specific guidance for OIDC authentication failures caused by custom-webhook pipelines.
Cargo.toml	Advances the runner package to the corresponding alpha release version.
Cargo.lock	Synchronizes the locked root-package version with Cargo.toml.

Sequence Diagram

sequenceDiagram
    participant Runner
    participant Provider as CircleCI Provider
    participant CLI as circleci CLI
    participant Benchmarks
    participant Backend as CodSpeed Backend

    Runner->>Provider: check_oidc_configuration()
    Provider->>CLI: "run oidc get (aud=codspeed.io)"
    CLI-->>Provider: Preflight token
    Provider-->>Runner: OIDC available
    Runner->>Benchmarks: Execute benchmarks
    Benchmarks-->>Runner: Completed runs
    loop Each upload
        Runner->>Provider: set_oidc_token()
        Provider->>CLI: "run oidc get (aud=codspeed.io)"
        CLI-->>Provider: Fresh token
        Runner->>Backend: Upload with token
    end

Loading

_{Reviews (2): Last reviewed commit: "fix(run-environment): decide CircleCI OI..." | Re-trigger Greptile}

[codspeed-hq]

Performance comparison unavailable

The base and head of this comparison were measured with different runner settings, so their benchmark values are not directly comparable.

What changed between base and head:

• Cycle estimation (off → on) changes how benchmark performance is calculated. Learn more about cycle estimation
• Allocator-time exclusion (off → on) removes allocator time from the measurement, which shifts benchmark values. Learn more about allocator-time exclusion

Re-run the base with the same settings to get a valid performance comparison.

---

_{Comparing feat/circleci-oidc-upload-auth (28253fc) with feat/circleci-run-environment (4e52cfa)}

[fargito]

@greptileai review