Set the eval-test federation rule id

docs/build-plan.md

@@ -244,7 +244,8 @@ Scope (owner, 2026-11-05, spec P6-5): the review targets are the 4 pilot repos;
 - [ ] Keep the supported repo inventory current. A repo joins or leaves through a PR to this repo. A new target: immutable subject first, a test PR right after, then a run on each open PR.
 - [x] Owner: Phase 6 also applies the org security configurations. Done and read back 2026-11-05: the configuration for public repos is enforced on the active public repos and is the default for new public repos; the dependency configuration is enforced and is the default for new private and internal repos. One planned change to the dependency configuration is skipped by owner decision (spec P6-5). Details are kept in the owner's records.
 - [x] Eval environment split, code part (spec P6-4): `eval.yml` uses `eval` on `main` and `eval-test` on any other ref, chosen by an exact, case-sensitive shell test in a select job with no permissions, whose one output also sets `EVAL_ENVIRONMENT` (an Actions expression compares without case, so `MAIN` would have chosen `eval`); `evals.py` holds the federation IDs per environment and fails closed on another value and on an environment whose rule is not set; the workflow unit test allows the two names only in `eval.yml`.
-- [ ] Owner: create the `eval-test` environment on `.github` (required reviewer the owner, "prevent self-review" on, admin bypass as `eval`), and its federation rule on the test workspace (as the eval rule, with the exact claim `environment: "eval-test"`). Then set the rule ID in `evals.py` in a PR, and test it as V27: an approved `eval-test` run on a branch gets a token; a run with no environment, or in another environment, gets none. Until then branch evals fail closed ("eval-test federation rule not configured").
+- [x] Owner: create the `eval-test` federation rule on the test workspace: `eval-test-federation-rule`, created 2026-11-06 as a copy of the `eval` rule (same issuer, subject prefix, owner, repository and event claims, scope `workspace:developer`, service account, workspace and 600 s lifetime) with the exact claim `environment: "eval-test"`. Its ID is set in `evals.py` (`fdrl_01WkhnTsBLVnYBHgAfxkugnc`).
+- [ ] Test the `eval-test` rule as V27: an approved `eval-test` run on a branch gets a token; a run with no environment, or in another environment, gets none. The fail-closed path ("eval-test federation rule not configured") stays in the code for an unset entry, and a unit test covers it.
 - [x] Release item: summary comment format (spec P6-1): one row per cause, the repo setting label for a Dependency graph that is off, plain paths, no empty token table, and the informational unsigned-commit row with the signing guide link. Display only; the gate does not change. Shipped in 364058d (PR #26), released 2026-11-04.
 - [ ] Release item: comment fixes from the first live run (spec P6-3): the TIP callout names the signing step when the unsigned-commit row shows, "commit" for a one-commit PR, no setting label on a negated message, and an error body cut off mid-read is treated as empty. Display only; the gate does not change. The same release carries the harden-runner v2.22.3 and setup-uv v10.3.3 pins (audit mode stays; `releases.astral.sh` added to the setup-uv jobs' allowlists). Ships as in "Each release".