fix: allow canonical audit OIDC job identity

[Pigbibi]

Summary

• pin the canonical codex_audit.yml@refs/heads/main identity in the service job_workflow_ref allowlist
• keep the deploy-script and VPS workflow allowlists identical
• document and test the exact, non-wildcard trust entry

Live evidence

• main audit run 30692498663 reached the VPS service but was rejected with OIDC job workflow ref is not allowed
• read-only VPS inspect run 30692566204 confirmed the deployed job allowlist only contains retired audit refs plus QPK reusable refs, not the canonical codex_audit.yml identity

Security boundary

• exact protected-main workflow identity only; no wildcard and no retired PR-review identity restored
• existing repository, workflow, ref, visibility, direct-repository, and QPK SHA checks remain unchanged

Validation

• regression test was RED before the config change and passes after it
• python3 -m unittest tests.test_run_monthly_codex_audit tests.test_oidc_reusable_workflow_auth (120 tests, 1 skipped)
• bash -n scripts/deploy_codex_audit_service.sh
• python3 -m ruff check tests/test_run_monthly_codex_audit.py