[MichaelGHSeg]

Summary

The first tag-triggered publish (segment_analytics-v2.0.0, run 41677577466) reached dart pub publish --force with no credentials. Pub fell back to its interactive OAuth flow ("Pub needs your authorization… Waiting for your authorization…"), whose localhost callback is on the runner, so the job hangs.

dart pub publish does not request the GitHub OIDC token itself. pub.dev's example workflow uses dart-lang/setup-dart, whose createPubOIDCToken() requests an ID token for audience https://pub.dev, exports it as PUB_TOKEN, and runs dart pub token add https://pub.dev --env-var PUB_TOKEN. Org policy admits only actions/*, and our setup-flutter action doesn't do this, so this PR does the same thing inline in the publish step:

• request the ID token from ACTIONS_ID_TOKEN_REQUEST_URL with audience=https://pub.dev (the job already has id-token: write)
• fail with an error if no token comes back, mask it, register it with dart pub token add, then publish
• timeout-minutes: 15 on the publish job, so any future credential problem fails fast instead of waiting for the 6h job limit

Recovering 2.0.0

The segment_analytics-v2.0.0 tag points at the #224 merge commit, whose publish.yml lacks this fix, so re-running that run won't help. After this merges, publish core with workflow_dispatch from main (package: core). That is the re-run path in RELEASING.md and is enabled on pub.dev. main then contains exactly the 2.0.0 release plus this workflow change; the package contents are identical. The tag stays on the release commit.

Testing

YAML parses, and the step mirrors setup-dart's createPubOIDCToken() (dart-lang/setup-dart lib/main.dart). The OIDC exchange itself can only be exercised by a real publish; the dispatch above is that test.