Opening this as a place to discuss. I will open the PR assuming I get 👍🏼

In looking into pypi-attestations, I see it relies on this package.

This package does the ambient discovery for circleci. circleci introduced support for the --root-issuer flag to force the iss to be oidc.circleci.com

Is there any issue with adding support for this with a root_issuer bool option?
since detect actually executes the command to generate the token.

def detect_circleci(audience: str, root_issuer: bool) -> str | None:
...

I'll then open a separate pr for the sigstore package to set this flag (tbh still tracing my way through the parts, but feels like this is the source where we should at least expose the option to begin with)