* impl. local kube * add support for op injected oidc secrets * ci: set least-privilege workflow token permissions