Let trusted automation start CI

[ariofrio]

Summary

• Mint repository-scoped GitHub App tokens for Changesets and same-repository screenshot updates.
• Leave the ordinary GITHUB_TOKEN read-only and keep fork pull requests on the read-only fallback.
• Test the workflow authentication contract.

Why

GitHub now puts pull_request runs caused by GITHUB_TOKEN-created or updated pull requests into an approval-required state. GitHub recommends a GitHub App installation token or personal access token when the event should trigger automatically: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow

Verification

• npm test
• npm run check:ui
• npm run check:layout
• npm run check:heading-icons
• actionlint v1.7.7
• git diff --check

_{Written by Codex}