* feat: add end_user_email claim to OIDC ID tokens
When a job is triggered by an app end user, the OIDC ID token now
includes the end_user_email claim automatically. The claim is omitted
for jobs without an end user (regular script/flow runs).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* update ee ref
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>