This pull request improves the way service account and user identity are verified in the token-service and simplifies logging. The main focus is on making authentication more robust by prioritizing Cloud Run's injected headers and handling cases where service accounts lack an email claim.

Authentication improvements:

• Updated verify_service_account_identity in main.py to first check for the X-Goog-Authenticated-User-Email header injected by Cloud Run, extracting the email directly if present. If absent, falls back to decoding the JWT token and extracting the email or a placeholder for service accounts without an email claim. [1] [2]

Logging simplification:

• Removed unnecessary info-level logging of found GitHub handles in get_github_handle_from_workspace_sa, and removed logging when generating custom tokens in generate_custom_token, reducing log noise. [1] [2]