fix(auth): enforce trusted external identity attributes before provisioning

[XiaoSeS]

Parent

#628

What to build

Harden the existing OAuth/OIDC login path so access and profile updates use only provider attributes with sufficient assurance, and so non-interactive or non-active platform accounts are rejected before external profile data is written.

Acceptance criteria

• An unverified email cannot satisfy EMAIL_DOMAIN access policy.
• An unverified email is not persisted for a new account and does not overwrite an existing trusted email.
• GitHub email assurance comes from the authenticated emails endpoint; a profile fallback remains unverified.
• Existing PENDING, DISABLED, and MERGED bindings fail with stable login outcomes.
• System accounts cannot obtain an interactive OAuth session.
• Account-state rejection happens before profile updates or role loading.
• GitHub, GitLab, OIDC, access-policy, binding, and login-handler regression tests pass on Java 21.
• The change is integrated into big-main and validated before any merge to main.

Blocked by

None - can start immediately.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p1 (4.0/5)
• Effort: effort/l (5/5)
• Confidence: 1/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (auth, login).
• Contains urgency signals (regression, cannot).
• Issue is missing key context (summary, steps to reproduce, expected behavior).

High-Risk Signals

• Mentions sensitive areas (auth).

Missing Info

• Please add summary.
• Please add steps to reproduce.
• Please add expected behavior.

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: summary, steps to reproduce, expected behavior.

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p1 (4.0/5)
• 修复投入: effort/l (5/5)
• 信息完整度: 1/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（auth, login）
• 包含紧急信号（regression, cannot）
• 缺少关键上下文（summary, steps to reproduce, expected behavior）

高风险信号

• 提到敏感区域（auth）

缺失信息

• 请补充 summary.
• 请补充 steps to reproduce.
• 请补充 expected behavior.

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.