Identity-bound lock-context tests never execute in CI (gated on unset USER_JWT)

[coderdan]

Problem

packages/stack/__tests__/lock-context.test.ts gates its four identity-bound encryption tests on process.env.USER_JWT and silently returns (logging "Skipping…") when it's absent:

const userJwt = process.env.USER_JWT
if (!userJwt) {
  console.log('Skipping lock context test - no USER_JWT provided')
  return
}

USER_JWT is set in no workflow (grep of .github/ finds zero references), so these tests are always skipped in CI and the job stays green regardless.

Why it matters

This is the only test of the strategy-based identity path — OidcFederationStrategy → .withLockContext({ identityClaim }) — that replaced the old LockContext.identify(jwt) ceremony (#497). With it skipped, that path has zero executed coverage: a regression in the federation flow, the lock-context wiring, or the OidcFederationStrategy.create signature would ship a green build. The auth 0.39 → 0.40 bump (which changed OidcFederationStrategy.create to take a workspaceCrn) is currently only validated by the type/build check, not at runtime.

Contrast the wasm-e2e-tests job, which deliberately added a fail-loud guard ("Assert CS_* secrets are present") precisely so a missing/rotated secret can't hide a regression behind a skipped test.

Proposed fix

1. Provision a test end-user OIDC JWT for CI (USER_JWT) — likely minted at job start rather than a static secret, since end-user JWTs expire.
2. Expose it in the run-tests job env alongside the existing CS_* secrets.
3. Add a fail-loud guard mirroring the WASM E2E job: error if USER_JWT is unset in CI so the identity tests can't silently skip.

Found during the code review of the auth 0.40 bump on #497.

[coderdan]

Resolved by #620 — a freshly-minted Clerk M2M JWT replaces the never-provisioned USER_JWT gate, so the lock-context (6/6) and matrix-identity (2/2) suites now run green in CI. Merged into the 1.0 candidate #535.