Downgrade jwt_reparse from alert to debug log

[iain-macdonald]

The jwt_reparse alert.UnexpectedEvent added in #11754 fires on the normal cloud executor authentication path — it's not an actual unexpected reparse, it's the initial (and only) parse of the JWT for every task execution.

The call flow:

1. priority_task_scheduler.go:585 — sets only the raw ES256-signed JWT string in the context
2. executor.go:200 — calls interceptors.AddAuthToContext
3. interceptors.go:96 — calls AuthenticatedGRPCContext
4. oidc.go:558 — calls authenticateGRPCRequest(ctx, true)
5. oidc.go:501-543 — peer certs, SSL headers, API keys, basic auth, authority all miss (local context, no gRPC metadata)
6. oidc.go:547 — falls through to claims.ClaimsFromContext(ctx)
7. claims.go:490 — no cached claims (nobody parsed the JWT yet)
8. claims.go:497 — no auth error (first auth attempt)
9. claims.go:498 — finds the JWT string
10. claims.go:503 — fires jwt_reparse alert (misleading — this is the first parse)
11. claims.go:504 — calls parseClaims with DefaultKeyProvider (no LRU cache)
12. claims.go:590-591 — tries HS256 key first, fails
13. claims.go:594-595 — tries ES256 key, expensive elliptic curve verification succeeds
14. oidc.go:560 — AuthContextWithJWT re-assembles a new HS256 JWT from the claims and caches both in context

This downgrades the alert back to the rate-limited debug log it was
before #11754.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adjusts JWT parsing instrumentation in ClaimsFromContext to avoid emitting a monitoring alert on the normal cloud executor authentication path, while still retaining a low-noise diagnostic signal.

Changes:

• Replace alert.CtxUnexpectedEvent(ctx, "jwt_reparse", ...) with a rate-limited debug log.
• Introduce a named, rate-limited sub-logger (reparseLog) to cap log volume (once per minute).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.