fix(lambda): add jti claim to GitHub App JWTs to prevent concurrent collisions

[jensenbox]

Summary

Fixes concurrent JWT collisions that cause silent job loss during burst workloads.

When multiple scale-up Lambda invocations generate GitHub App JWTs within the same second, universal-github-app-jwt produces byte-identical tokens (same iat, exp, iss, no jti). GitHub rejects the duplicates, returning HTTP 404 on POST /app/installations/{id}/access_tokens, which triggers silent batch dropping.

Root cause

universal-github-app-jwt generates JWTs with only { iat, exp, iss } claims. The iat uses seconds precision (Math.floor(Date.now() / 1000)). With the same App ID and private key, concurrent invocations within the same second produce identical tokens.

Fix

Replace privateKey-based auth with a custom createJwt callback — a first-class API in @octokit/auth-app v8.x that completely bypasses universal-github-app-jwt. The callback:

• Signs JWTs using node:crypto.createSign (zero new dependencies)
• Includes a crypto.randomUUID() jti claim, ensuring every token is unique
• Preserves the existing iat/exp logic (30s safety margin, 10-minute expiry)
• Properly forwards the timeDifference parameter for clock drift correction
• Supports both PKCS#1 and PKCS#8 private key formats (via node:crypto)

Changes

• lambdas/functions/control-plane/src/github/auth.ts — replace privateKey with createJwt callback in createAuth()
• lambdas/functions/control-plane/src/github/auth.test.ts — update tests to assert createJwt instead of privateKey, add test verifying unique JWTs with jti

Test coverage

• Existing tests updated to verify createJwt callback is passed instead of privateKey
• New test generates two JWTs in rapid succession and verifies they differ (proving jti uniqueness)
• New test validates JWT structure (header.payload.signature) and verifies jti, iat, exp, iss claims are present
• All 343 control-plane tests pass

Fixes #5025

[Brend-Smits]

Hey!
Thanks for this great contribution 🚀
Tested this in our testing environment and things seem to work well. Okay from me (and @stuartp44) side.