feat(run-environment): log which authentication method the run uses

[fargito]

The runner resolves how it authenticates from the environment rather than being
told, so nothing in its output distinguished a job uploading with an OIDC token
from one falling back to tokenless because the workflow forgot id-token: write.
Both succeed. It now prints the method and a link to the run environment's
authentication docs, alongside the upload it describes:

Authentication: OIDC token minted by GitHub Actions
Learn more at https://codspeed.io/docs/integrations/ci/github-actions/configuration#authentication

The method is tracked rather than inferred: CodSpeedAPIClient holds an
Authentication carrying the token together with the source that produced it.
Logging it after the mint rather than before the benchmarks means a failed mint
that falls back to a tokenless upload is reported as tokenless, not as OIDC.

A token GitLab CI issues through id_tokens arrives in CODSPEED_TOKEN, where
a static token would, so it is reported as the CODSPEED_TOKEN it came from:
accurate, but a GitLab user running OIDC never sees the word OIDC.

The shared documentation links moved into constants, so the uploader's 401 hint
and the OIDC guidance no longer repeat URLs the new line also needs. Buildkite's
401 hint gains the link it was missing.

Worth a look: CodSpeedAPIClient::new takes an Authentication, and
with_token / set_token become with_authentication / set_authentication.
Every caller passes the same token through the matching variant, so no request
changes.

Closes COD-3406

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 17 untouched benchmarks

---

_{Comparing cod-3406-add-an-info-level-log-to-tell-users-which-authentication (4ea6774) with main (e89df29)}

[greptile-apps]

Greptile Summary

The PR tracks authentication provenance alongside credentials and reports the method used for result uploads.

• Introduces explicit OIDC, run-token, CLI-login, and tokenless authentication variants.
• Logs authentication after OIDC refresh so the message reflects the upload credential.
• Centralizes CI authentication documentation links and improves authentication guidance.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/api_client.rs	Replaces the optional token field with an authentication model that retains both credentials and their provenance.
src/cli/mod.rs	Maps run-level tokens, configured login credentials, and missing credentials to the corresponding authentication variants.
src/executor/orchestrator.rs	Reports the effective authentication method after per-upload OIDC refresh and before the first upload.
src/run_environment/github_actions/provider.rs	Records successfully minted GitHub Actions credentials as OIDC authentication.
src/run_environment/circleci/provider.rs	Records successfully minted CircleCI credentials as OIDC authentication and reuses centralized documentation URLs.
src/run_environment/interfaces.rs	Centralizes authentication documentation URLs and exposes the appropriate link for each run environment.
src/upload/uploader.rs	Reuses centralized authentication documentation links in unauthorized-upload guidance.

Sequence Diagram

sequenceDiagram
    participant CLI
    participant Provider as Run Environment Provider
    participant Client as API Client
    participant Upload
    CLI->>Client: Construct with resolved Authentication
    Provider->>Client: Refresh OIDC authentication when configured
    Client-->>CLI: Expose effective authentication label
    CLI->>CLI: Log authentication method and documentation link
    CLI->>Upload: Upload results with effective token

Loading

_{Reviews (2): Last reviewed commit: "feat(run-environment): log which authent..." | Re-trigger Greptile}

[fargito]

@greptileai review