fix(iam): match org-baseline policy-check OIDC subject (PLAT-234) (#155)

Pull request tokens use repo:ORG/seahaven-org-baseline:pull_request.
Merge queue tokens use the gh-readonly-queue ref. The previous
refs/pull/* subject never matched either.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>

oidc-deploy-roles.yaml

@@ -1177,6 +1177,18 @@ Resources:
       AssumeRolePolicyDocument:
         Version: "2012-10-17"
         Statement:
+          - Effect: Allow
+            Principal:
+              Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
+            Action: sts:AssumeRoleWithWebIdentity
+            # pull_request jobs with no environment use sub
+            # repo:ORG/seahaven-org-baseline:pull_request. refs/pull/N/merge is
+            # the ref claim, not sub. A second statement is required: StringEquals
+            # and StringLike in one condition are AND.
+            Condition:
+              StringEquals:
+                token.actions.githubusercontent.com:aud: sts.amazonaws.com
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:pull_request
           - Effect: Allow
             Principal:
               Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
@@ -1185,11 +1197,7 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub:
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/gh-readonly-queue/main/*
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
-                  # use_immutable_subject is false, so pull_request tokens use
-                  # repo:ORG/seahaven-org-baseline:ref:refs/pull/N/merge.
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/pull/*
       Policies:
         - PolicyName: access-analyzer-policy-check
           PolicyDocument: