case 1: no id token, push to the default branch
    IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
    IRONSTAR_EVENT=push
    IRONSTAR_PR_NUMBER=''
    IRONSTAR_IS_PRODUCTION=true
    IRONSTAR_BRANCH=main
    IRONSTAR_PREVIEW_SLUG=main
  ok   source = branch-name
  ok   event = push
  ok   production = true
  ok   slug = main
case 2: no id token, pull request as the current service reports it
    IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
    IRONSTAR_EVENT=pull_request
    IRONSTAR_PR_NUMBER=42
    IRONSTAR_IS_PRODUCTION=false
    IRONSTAR_BRANCH=refs/pull/42/merge
    IRONSTAR_PREVIEW_SLUG=refs/pull/42/merge
  ok   source = branch-name
  ok   event = pull_request
  ok   pr-number = 42
  ok   production = false
  ok   slug = refs/pull/42/merge
case 3: no id token, tag push (no branch)
    IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
    IRONSTAR_EVENT=push
    IRONSTAR_PR_NUMBER=''
    IRONSTAR_IS_PRODUCTION=false
    IRONSTAR_BRANCH=''
    IRONSTAR_PREVIEW_SLUG=abc1234
  ok   event = push
  ok   production = false
  ok   slug = abc1234
case 4: id token, push to the default branch
    IRONSTAR_RUN_CONTEXT_SOURCE=id-token
    IRONSTAR_EVENT=push
    IRONSTAR_PR_NUMBER=''
    IRONSTAR_IS_PRODUCTION=true
    IRONSTAR_BRANCH=main
    IRONSTAR_PREVIEW_SLUG=main
  ok   source = id-token
  ok   event = push
  ok   production = true
  ok   branch = main
  ok   slug = main
case 5: id token, pull request targeting the default branch
        (the eval-time branch is 'main' here: that is the defect)
    IRONSTAR_RUN_CONTEXT_SOURCE=id-token
    IRONSTAR_EVENT=pull_request
    IRONSTAR_PR_NUMBER=42
    IRONSTAR_IS_PRODUCTION=false
    IRONSTAR_BRANCH=''
    IRONSTAR_PREVIEW_SLUG=pr-42
  ok   source = id-token
  ok   event = pull_request
  ok   pr-number = 42
  ok   production = false
  ok   branch = 
  ok   slug = pr-42
case 6: id token, push to a non-default branch
    IRONSTAR_RUN_CONTEXT_SOURCE=id-token
    IRONSTAR_EVENT=push
    IRONSTAR_PR_NUMBER=''
    IRONSTAR_IS_PRODUCTION=false
    IRONSTAR_BRANCH=topic
    IRONSTAR_PREVIEW_SLUG=topic
  ok   event = push
  ok   production = false
  ok   slug = topic
case 7: id token, scheduled run (no ref claim)
    IRONSTAR_RUN_CONTEXT_SOURCE=id-token
    IRONSTAR_EVENT=schedule
    IRONSTAR_PR_NUMBER=''
    IRONSTAR_IS_PRODUCTION=false
    IRONSTAR_BRANCH=''
    IRONSTAR_PREVIEW_SLUG=main
  ok   event = schedule
  ok   production = false
case 8: id token requested but refused: fail closed, never fall back
curl: (22) The requested URL returned error: 401
----------------------------------------
Exception occurred during processing of request from ('127.0.0.1', 37858)
run-context: id-token request to http://127.0.0.1:43573/api/v1/id-token failed
  ok   refused token request aborted the effect