fix(ci): drop musl target from fuzz.yml + add id-token to mythos-auto (#168)

[avrabe]

Summary

Two CI workflow plumbing fixes bundled. Both surfaced by PR #169's matrix scan once smithy's #167 (unzip) fix landed on the runner image.

Fix 1: drop musl target from fuzz.yml (closes #168)

Per smithy team's root-cause analysis on #168:

The "sanitizer is incompatible with statically linked libc" error was NOT runner config drift. All 7 rust-cpu runners have identical toolchains. The actual problem: dtolnay/rust-toolchain@nightly with: targets: x86_64-unknown-linux-musl installed the musl toolchain target. cargo-fuzz's --release reuse path can pick up a musl-built artifact on cache restore, and musl statically links libc which is incompatible with the AddressSanitizer cargo-fuzz injects.

Change	Why
Drop targets: x86_64-unknown-linux-musl from toolchain install	cargo-fuzz uses the host gnu target by default, sanitizer-compatible
Bump actions/cache key prefix to v2-	Invalidate ALL existing cache snapshots once, including musl-contaminated ones

The musl target isn't referenced anywhere else in the repo (grep -rn musl meld-core/ fuzz/ → 0 matches outside the dropped line).

Fix 2: add id-token: write to mythos-auto.yml

After #167's unzip fix landed and PR #169's matrix scan ran far enough to invoke claude-code-action, a third plumbing issue surfaced:

error: Error message: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
Attempt 3 failed: Could not fetch an OIDC token. Did you remember to
add `id-token: write` to your workflow permissions?

claude-code-action calls core.getIDToken() early in setupGitHubToken. The OIDC issuer URL is injected as ACTIONS_ID_TOKEN_REQUEST_URL env var only when the workflow has permissions.id-token: write. Adds the permission with inline rationale.

The token is workflow-scoped and signed by GitHub; doesn't grant access beyond what the workflow already has.

Test plan

• CI green on this PR (note: own mythos-auto won't fire — workflow changes aren't Tier-5 source)
• Next Tier-5 PR (e.g., test(fact): LS-A-8 regression for inner-list rep_func selection #169 if re-pushed) sees fuzz smokes pass without gh run rerun --failed
• Next Tier-5 PR sees mythos-auto actually run claude-code-action through prompt completion (the unzip ✓ + OIDC ✓ combination)
• Advances Smithy fleet reliability — rolling tracker (meld side) #139's "3 consecutive non-admin merges" criterion

Sequencing

• smithy: unzip missing on rust-cpu runners blocks claude-code-action #167 (unzip on rust-cpu) ✅ closed by smithy
• This PR (fix(ci): drop musl target from fuzz.yml + add id-token to mythos-auto (#168) #170): meld-side workflow fixes
• After merge: PR test(fact): LS-A-8 regression for inner-list rep_func selection #169 (LS-A-8) should pass fuzz cleanly and trigger a real mythos-auto matrix scan

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 19/19 approved LS entries verified

	count
Passed (≥1 test, all green)	19
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}