auth: bind GitHub OIDC token exchange to a per-deployment audience (#1229)

## What this does

The publisher CLI now derives the OIDC audience to request from the
`--registry` URL instead of using a fixed constant, and the server
validates the token's `aud` claim against a new per-deployment env var
(`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`).

Production sets this env var to
`https://registry.modelcontextprotocol.io` (and per-environment URL
elsewhere), so the deployment only accepts tokens that were requested
for it.

## Compatibility

This is a breaking change for older `mcp-publisher` binaries that still
request the legacy hardcoded audience. After this rolls to a deployment,
users on old `mcp-publisher` will see a clear `invalid audience:
expected …, got […]` error and need to upgrade. Users following the
documented `releases/latest` install pattern get the new binary
automatically.

## Test plan

- [ ] CI green
- [ ] Run a synthetic publish from a real GitHub Actions workflow
against staging after deploy
- [ ] Confirm an older `mcp-publisher` against the same staging deploy
returns the expected `invalid audience` error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/publisher/auth/github-oidc.go

@@ -7,7 +7,9 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
+	"strings"
 )
 
 type GitHubOIDCProvider struct {
@@ -23,8 +25,13 @@ func NewGitHubOIDCProvider(registryURL string) Provider {
 
 // GetToken retrieves the registry JWT token using GitHub Actions OIDC token
 func (o *GitHubOIDCProvider) GetToken(ctx context.Context) (string, error) {
+	audience, err := audienceFromRegistryURL(o.registryURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid --registry URL: %w", err)
+	}
+
 	// Get OIDC token from GitHub Actions endpoint
-	oidcToken, err := o.getOIDCTokenFromGitHub(ctx)
+	oidcToken, err := o.getOIDCTokenFromGitHub(ctx, audience)
 	if err != nil {
 		return "", fmt.Errorf("failed to get OIDC token from GitHub: %w", err)
 	}
@@ -99,8 +106,8 @@ func (o *GitHubOIDCProvider) exchangeOIDCTokenForRegistry(ctx context.Context, o
 	return tokenResp.RegistryToken, nil
 }
 
-// getOIDCTokenFromGitHub fetches the OIDC token from GitHub Actions endpoint
-func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string, error) {
+// getOIDCTokenFromGitHub fetches the OIDC token from GitHub Actions endpoint.
+func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context, audience string) (string, error) {
 	// Check for required environment variables
 	requestToken := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
 	if requestToken == "" {
@@ -113,7 +120,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string
 	}
 
 	// Build the full URL with audience parameter
-	fullURL := requestURL + "&audience=mcp-registry"
+	fullURL := requestURL + "&audience=" + url.QueryEscape(audience)
 
 	// Create the request
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) //nolint:gosec // G704: URL is from GitHub Actions ACTIONS_ID_TOKEN_REQUEST_URL env var
@@ -158,3 +165,19 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string
 
 	return tokenResp.Value, nil
 }
+
+// audienceFromRegistryURL returns scheme + lowercased host for the given URL.
+func audienceFromRegistryURL(registryURL string) (string, error) {
+	registryURL = strings.TrimSpace(registryURL)
+	if registryURL == "" {
+		return "", fmt.Errorf("registry URL is empty")
+	}
+	u, err := url.Parse(registryURL)
+	if err != nil {
+		return "", fmt.Errorf("parse %q: %w", registryURL, err)
+	}
+	if u.Scheme == "" || u.Host == "" {
+		return "", fmt.Errorf("registry URL must include scheme and host: %q", registryURL)
+	}
+	return u.Scheme + "://" + strings.ToLower(u.Host), nil
+}