CI / Build and push docker image (push) Successful in 1m8s
The free-form "name" claim can change and two accounts can share it; preferred_username is the account's stable handle. display_name() now falls back preferred_username -> name -> email -> sub, with tests pinning the claim priority.