Authenticate GitHub marketplace API requests via RFC 8693 token exchange - #325815

PR classified as community.

⚠️ Head commit is NOT signed by a trusted team member, so the full 3-approval requirement applies. (Head commit signature not verified (reason: unsigned).)

Tip: to earn the credit (−1 approval), the head commit must be signed by you with one of your own keys listed in security/trusted-signing-keys.csv. A "Verified" badge that GitHub adds to commits it creates on your behalf — web-editor edits, applied suggestions, Codespaces, API commits — does not count.

⚠️ Collaborator approvals: 0/3.

Needs 3 more collaborator approvals to merge.

✅ No newly added runnable binary files.