[jog1t]

• rivet-token is optional: when the job grants id-token: write, the Rivet CLI exchanges the job's GitHub OIDC token for a short-lived cluster credential, using the cluster's GitHub Actions trust
• The README documents trusts plus id-token: write as the default setup, and keeps rivet-token as the alternative
• Needs a Rivet CLI release that includes the GitHub Actions OIDC exchange; bump rivet-cli-version in the example once it ships