Artifact Registry token exchange names the caller's home organization, not the addressed one

Closed Beta blocker: Broken main path (authentication)

A user homed in one organization but addressing another gets a token naming the wrong organization, which Artifact Registry rejects. For the user: the registry looks empty or broken at first login. Beta organizations are new while their users stay homed elsewhere, so this can hit every beta user.

<🤖>

Summary

Authn::TokenExchange::TokenIssuer scopes the token it mints to the acting user's home organization, not the organization the request targets. TokenIssuer#organization_uuid reads @user.organization.uuid (under a Gitlab/AvoidUserOrganization disable whose comment states the intent). A user who is a member of organization B but homed in organization A therefore presents a token naming A while addressing a namespace in B.

Why this matters now

The per-user Artifact Registry credential seam (ArtifactRegistry::TokenExchange#token_for, #623370 (closed)) now mints this token for every per-user AR GraphQL request. The Rails gate for those requests is bare membership at any access level (read_artifact_registry on the queried organization), so the cross-organization case is reachable: the request passes the Rails gate on B, sends AR a token naming A, and AR rejects it.

The rejection currently renders as an empty registry connection (a 403 from AR maps to a null query result). A log line was added at the resolver so the rejection is greppable, but the token still names the wrong organization.

Same defect one layer down

This is the same shape recorded against ops/artifact-registry#473, where artifactRegistryRoleBulkGrant scoped its writes to the caller's home organization and the staging grant failed for exactly this reason.

Scope

Making the token name the addressed organization is a change to the issuer's contract (group::authentication) and, depending on the approach, to AR's verifier. It is out of scope for the client seam, which cannot override the issuer.

Acceptance

• A user acting on an organization they are a member of but not homed in receives a token naming the addressed organization.
• The home-organization assertion pinned in ee/spec/lib/artifact_registry/token_exchange_spec.rb (which exists so this fix fails loudly) is updated when the behavior changes.

</🤖>