Tenant RGD's matchOIDCIdentity must follow the single-entry alternation before RGD tenants repoint #2405

🤖 Generated by the Daily AI Assistant

Problem. The tenant ResourceGraphDefinition (k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml) templates each tenant's OCIRepository with a single matchOIDCIdentity subject pinned to the reusable-workflows publish-app.yaml path. When an RGD-instantiated tenant's repo repoints its cd workflow to devantler-tech/actions (the actions#425 train), that tenant's artifact verification will fail — and the fix must NOT be a second identity entry: cosign's keyless attestation verification rejects multiple identities outright (unsupported: multiple identities are not supported at this time), which is exactly how #2399 froze the apps layer (root-cause fix: #2404).

Proposed direction. Apply the same single regex-alternated subject as #2404 — devantler-tech/(reusable-workflows|actions) — to the RGD template, and narrow it to actions-only together with the #2404 cleanup once all consumers have shipped an actions-signed artifact. Relates to the #2402 matcher hardening.

Size. Small (one templated subject line + validate).