Add support for check run ID for GitHub Actions provenance

[haydentherapper]

Description

See https://github.blog/changelog/2025-11-13-github-actions-oidc-token-claims-now-include-check_run_id/ for more info. We should also investigate if other CI providers have a similar claim so we can standardize across ecosystems.

cc @kommendorkapten @steiza