Giving Cloud Agents Production Access with OIDC, Not Secrets — Blankdot