[Tech Debt] Replace PRIVATE_REFERENCES_TOKEN PAT with GitHub App installation tokens

[CTristan]

CI in six repos (ConfigurationManager.Integration, lobotomy-corporation-mods, open-lobotomy-tooling, debug-panel, LobCorp.ConfigurationManager, and the reusable workflows in this repo) checks out the private game-references repo with PRIVATE_REFERENCES_TOKEN, an org secret backed by a personal fine-grained PAT. That credential shape has three problems:

• Expiry hard-fails CI fleet-wide. The "Detect private references" step in each consumer's ci.yml only checks that the secret is present, so an expired-but-present PAT fails the private-refs checkout outright instead of degrading to the documented skip-canary path. When the token lapses, every consumer repo goes red on the same day.
• Person-bound. The PAT lives on a personal account; account compromise or loss of org membership breaks all consumers at once.
• Recurring manual rotation. Someone must remember to regenerate it every expiry cycle, forever.

The current token is valid until 2027-04-05, so there is no urgency — this is resilience work, not a fire.

Proposed shape

Mint short-lived installation tokens per workflow run via actions/create-github-app-token, replacing the long-lived PAT:

1. Reuse the open-lobotomy-angela app from [Enhancement] Activate sync-org-docs workflow (create Angela GitHub App and one-time setup) #14 (it already carries Contents: Read & write) rather than creating a second app. The mint step downscopes per use — repositories: limited to the references repo and permission-contents: read — so consumers never hold write.
2. Install Angela on the repo behind the PRIVATE_REFERENCES_REPO org variable. If that repo is not org-owned, resolve ownership first (a private org-owned app can only install on the owning org's repos).
3. In each consumer workflow, add a mint step before the private-references checkout and feed its output token to actions/checkout. Route through the reusable workflows here where possible so consumers pick the change up centrally.
4. Once every consumer is migrated, delete the PRIVATE_REFERENCES_TOKEN org secret.

Acceptance criteria

• No workflow in any consumer repo references PRIVATE_REFERENCES_TOKEN.
• Private-references checkout works in all six consumer repos via app-minted tokens, verified by a green CI run each.
• The minted token is downscoped to contents: read on the references repo only.
• The graceful-degradation path still works: a repo without the app configuration skips the canary with the existing warning instead of failing.
• The PRIVATE_REFERENCES_TOKEN org secret is deleted.

Related

• [Enhancement] Activate sync-org-docs workflow (create Angela GitHub App and one-time setup) #14 — creates the Angela app this issue reuses; the cheapest path lands after [Enhancement] Activate sync-org-docs workflow (create Angela GitHub App and one-time setup) #14.
• Consumer workflows: dotnet-ci.yml / dotnet-ci-windows.yml in this repo, plus each consumer repo's ci.yml (and release.yml where present).