ci: add opt-in research publisher identity verification

[Pigbibi]

Scope

Add an opt-in identity_only workflow_dispatch input to the existing Theme Momentum Snapshot job. It defaults to false. Scheduled and normal manual runs retain their existing steps and permissions.

Identity-only runs require the expected repository, workflow path and main ref before minting. The official App-token action is pinned to v3.2.0 commit bcd2ba49218906704ab6c1aa796996da409d3eb1, scopes the token to this repository with Contents/PR write only, and retains automatic post-job revocation. The diagnostic only checks the expected installation and the exact single-repository token scope, using a fixed metadata GET with redirects disabled. Reports contain booleans and published=false.

Boundaries

• No checkout, dependency install, collection, provider call, generated output, data artifact, branch write or PR write in identity-only mode
• No new job, workflow, App permissions, Actions permission, bypass or auto-merge
• No private-key handling outside the official action; no response bodies, exception text, token or JWT in diagnostic logs
• Existing long-term publication behavior is unchanged. This does not enable automatic publication or approve any new public data
• No real identity run or token mint has been executed

Verification

• Exact two-file change based on 0a40f17; all other source blobs retained
• Full lightweight pytest: 162 passed; identity HTTP is mocked, never called live
• YAML parsed; after removing the opt-in input and diagnostic steps and restoring guards, the normal workflow structure is identical to baseline
• Wrong context, installation/repository mismatch, extra scope, pagination, HTTP/JSON/oversized response and sanitized failure cases covered
• Whitespace check passed

Keep this PR in draft for review. Any real identity-only run is a separate, explicitly approved step after merge.