tribuchet: building on jamie
check: oidc:mock:repo:github:example/app:ref:refs/heads/main -> agent/app (expect allow)
agent/app	allowed by ci
check: oidc:mock:repo:github:example/app:ref:refs/heads/main -> agent/other (expect deny)
agent/other	denied