fix(identity): gate SotyHub JobSpec issuance

[descambiado]

Summary

• keep SotyHub OIDC activation limited to trust and preflight by default
• require a separate BOFA_SOTYHUB_JOB_ISSUANCE_ENABLED=true decision before /execution/service/jobs
• pass every documented OIDC pin through Docker Compose
• expose the phase in the trust response so SotyHub can fail closed

Safety

• no worker dispatch or cloud mutation is added
• dispatch_performed=false remains unchanged
• no credentials, tokens, or private keys are stored in Compose or documentation

Verification

• python tools/verify_sotyhub_service_identity.py
• python tools/verify_execution_api.py
• python tools/verify_execution_fabric.py
• docker compose config --quiet
• git diff --check