feat(workflow): switch to streaming caretaker backend (v0.23.0)

[ianlintner]

Summary

Switch this repo's caretaker workflow to the new streaming backend model shipped in caretaker v0.23.0.

The runner no longer runs the orchestrator. It mints a GitHub Actions OIDC token, asks the caretaker backend to execute the run, and tails the resulting log stream so the Actions log still shows live output. The backend (which holds the GitHub App installation token + LLM keys) does all the work.

Why this changes

• No more CARETAKER_PAT Actions secret needed — workflow auths via short-lived OIDC.
• No more LLM keys in this repo's secrets — backend holds them centrally.
• No actions/checkout — backend pulls via the App.
• Bug fixes ship in the backend without you needing to update this YAML again.
• Job timeout drops from 30 min → 15 min (only tailing the SSE stream now).

The only configuration this workflow needs is vars.CARETAKER_BACKEND_URL, which has already been set to https://caretaker.cat-herding.net on this repo.

Breaking change

Caretaker is in unstable alpha; this is a single-shot rollout. The previous template that ran caretaker run directly will no longer work after merging this PR — but the new flow is functionally a superset (live logs in admin UI + GitHub Actions log, no PAT rotation, etc.).

Test plan

• After merging, watch the next scheduled run in the GitHub Actions tab — output should stream live (not just appear at the end).
• The admin UI at https://caretaker.cat-herding.net/streams should show this run live.
• If anything breaks, revert this PR — the previous template kept consumer repos self-contained and is fine to fall back to until the backend issue is resolved.

🤖 Generated with Claude Code

[the-care-taker]

🏠 Caretaker Status

Status: ⏳ Pending — PR pending: required_review_missing, ci_failing

Readiness Score: 30%

Readiness Breakdown

Component	Score
Mergeable & non-draft	10%
Automated feedback	20%
Reviews approved	0%
CI passing	0%
Total	30%

Blockers

• approval_required: The repository requires at least one approving review. (action: Request a review from a repository maintainer.)
• ci_failing: One or more required CI checks failed. (action: Investigate the failing check runs and push a fix.)

Ownership

• Owner: caretaker
• Claimed: 2026-04-27 15:31 UTC

---

This comment is edited in place as the PR progresses. Automated by Caretaker.

[ianlintner]

Superseded by the v0.25.0 fleet rollout — the thin streaming workflow this PR proposed (v0.23.0 era) has been replaced fleet-wide by the current v0.25.0 thin template that was merged today. The v0.25.0 template is a strict superset (operator-trigger workflow_dispatch + sparse 6h cron, no event-driven triggers) and ships with the F-5 / F-6 / F-7 fixes already applied. Closing as obsolete.