feat: add Buildkite OIDC credential detection

[cloudsmith-iduffy]

Summary

• detect Buildkite pipeline jobs via BUILDKITE and BUILDKITE_JOB_ID
• request a job OIDC token with buildkite-agent oidc request-token
• support the existing --oidc-audience / CLOUDSMITH_OIDC_AUDIENCE override, defaulting to cloudsmith
• register and document the buildkite detector

Testing

• uv run pytest -q cloudsmith_cli/core/tests/test_buildkite_detector.py cloudsmith_cli/core/tests/test_detector_controls.py
• env -u CLOUDSMITH_WORKSPACE -u CLOUDSMITH_ORG uv run pytest -q -m 'not integration'
• uv run pre-commit run --files cloudsmith_cli/core/credentials/oidc/detectors/buildkite.py cloudsmith_cli/core/credentials/oidc/detectors/__init__.py cloudsmith_cli/core/tests/test_buildkite_detector.py README.md

End-to-end validation

The detector was validated end to end with the reproducible cloudsmith-iduffy/cloudsmith-cli-oidc-test harness. Its Buildkite pipeline configuration downloads the Linux x86_64 GNU standalone binary built from this PR's commit ff2c7ceabcb6126643fc6c0e1b92b620eee0be1b, verifies its pinned SHA256, rejects CLOUDSMITH_API_KEY, and runs cloudsmith --debug whoami --verbose with an isolated home directory.

• Public pipeline: ian-duffy/cloudsmith-oidc-test
• Successful build: build #7
• Successful OIDC / whoami output: Cloudsmith OIDC smoke-test job

Detected OIDC environment: Buildkite
User: buildkite (slug: buildkite-4mav)
Authentication Method: SSO Token (primary)
PASS: Cloudsmith authenticated through Buildkite OIDC

No Cloudsmith API key was supplied or available to the job; authentication used the Buildkite-issued OIDC token with audience cloudsmith.