fix: correct three bugs in token minting and throttle classification

[jferrl]

Summary

Three defects, each pinned by a test written to fail against the current code first. A 403 permission failure was reported to callers as rate limiting, after stalling up to 60 seconds. Named identifier types were rejected despite the generic constraint promising them. A short application token expiration minted a JWT that had already expired, because issuance is backdated 60 seconds for clock drift and only the upper bound was clamped.

Changes

• A 403 counts as throttled only when it carries Retry-After, reports an exhausted budget, or says so in its message; Resource not accessible by integration is now terminal and unwrapped
• resolveIssuer switches on the reflect kind, honouring the ~int64 | ~string tildes for named types while keeping the zero-value rejection
• WithApplicationTokenExpiration rejects values at or below 90s, the backdate plus DefaultExpirySkew, and falls back to the 10 minute default
• Caps the error body read at 64 KiB, corrects an 8m30s arithmetic error in three comments, aligns the ErrRateLimited and WithRetryOnThrottle godoc with the new 403 contract, fixes a README example using a now-rejected value, and ignores .claude/

Rationale

The 403 message is consulted because a secondary rate limit can arrive with a healthy primary budget and no Retry-After; classifying that as terminal would strip the ErrRateLimited that callers with their own backoff branch on. The expiration floor is the backdate plus the skew rather than the backdate alone, because in between the cache can never hold the token and every call re-signs — a remote round trip for the KMS, HSM and Vault signers NewApplicationTokenSourceFromSigner exists to serve. The 60 second backdating is unchanged: it is what keeps a 10 minute expiry under GitHub's ceiling on a fast clock.

Migration Notes

A 403 with rate-limit headers but a healthy budget and no rate-limit message is no longer retried and no longer wraps ErrRateLimited. WithApplicationTokenExpiration values at or below 90s now fall back to 10 minutes; the README previously documented 1 * time.Minute, which is affected.

One premise could not be verified against live traffic: that GitHub attaches rate-limit headers to terminal 403s with a healthy remaining count. It is verified against mocks and GitHub's documented client guidance only.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.94%. Comparing base (14058b0) to head (5c0a82e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #63      +/-   ##
==========================================
+ Coverage   96.50%   96.94%   +0.44%     
==========================================
  Files           4        4              
  Lines         286      295       +9     
==========================================
+ Hits          276      286      +10     
+ Misses         10        9       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.