pub fn backend_workload_identity(
backend: &Backend,
) -> Option<(&WorkloadIdentity, WorkloadIdentityCloud)>Expand description
The backend’s workload-identity binding, if any, with its cloud plane.
Exhaustive over Backend (ADR §5.5): only S3/Azure/GCS can carry one —
the other backends’ auth types make it unrepresentable, and a new backend
cannot compile until its arm is decided here.