docs: publishing-from-github-actions.md sets invalid scope: admin on an organization-token auth-actions step

[workprentice]

Description

The GitHub Actions publishing example in content/docs/idp/guides/publishing-from-github-actions.md includes an auth-actions step that requests an organization access token but also sets scope: admin:

- name: Authenticate to Pulumi
  uses: pulumi/auth-actions@v1
  with:
    organization: ${{ env.PULUMI_ORG }}
    requested-token-type: urn:pulumi:token-type:access_token:organization
    scope: admin

Per pulumi/auth-actions' own action.yml, the scope input only has meaning for team tokens (team:TEAM_NAME) and personal tokens (user:USER_NAME); for organization tokens, no scope is required or accepted. admin isn't a documented valid value for scope under any token type. The canonical OIDC setup page (content/docs/administration/access-identity/oidc-issuers/github.md) confirms this: its organization-token example omits scope entirely.

A reader copying this example gets an extraneous input that has no effect (or could confuse auth-actions' scope parsing), and might reasonably conclude "admin" is a real access level for organization tokens, which it is not.

Reproduction / verification

Compared the scope input's documented behavior in pulumi/auth-actions/action.yml (both v1 and v2 tags define the same schema) against the two docs pages that construct an organization-token auth-actions step. Only publishing-from-github-actions.md includes the errant scope: admin; the OIDC reference page and every other page in the repo that requests an organization token correctly omit scope.

Fix

Remove the scope: admin line from the organization-token auth-actions step in publishing-from-github-actions.md.

Related but distinct: issue #20389 tracks emphasizing ESC OIDC as the default over Deployments OIDC on this page's surrounding guidance — this issue is scoped only to the incorrect scope input, not that broader framing question.