Migrate PUSH_TOKEN from PAT to GitHub App installation token

[stslex]

Context

PUSH_TOKEN is a personal access token with repo + workflow scopes and bypass rights on master branch protection. It is referenced by:

• .github/workflows/cut_release.yml — pushes the release branch, opens the PR.
• .github/workflows/sync_master_to_dev.yml — opens the master→dev sync PR via peter-evans/create-pull-request@v6.
• .github/workflows/android_deploy_prod.yml — pushes the release tag, runs gh pr merge --merge --delete-branch.
• .github/workflows/android_deploy_beta.yml — historically pushes back to dev (currently disabled).

This is one of the highest-blast-radius secrets in the repo, and tying it to a PAT means:

• It is bound to a single user account; if that account is compromised or churned, the release pipeline silently breaks.
• PATs expire on a calendar date. The pipeline goes red on that day with no advance warning.
• Scopes are coarse (repo covers everything in every repo the user has access to).

What's needed

1. Migrate to a GitHub App with installation-token-based auth:
   • Create a single-purpose app scoped to this repo with the minimum permissions needed (contents: write, pull-requests: write, actions: read).
   • Store the App ID + private key as repo secrets.
   • Workflows mint a short-lived installation token on the fly (e.g. via tibdex/github-app-token or actions/create-github-app-token).
2. Until the migration lands:
   • Calendar reminder for the current PAT's expiry date.
   • Document who owns the PAT and where the rotation runbook lives.

References

• documentation/release-flow.md §9 (Setup checklist) — PUSH_TOKEN requirements.
• All .github/workflows/*.yml referencing secrets.PUSH_TOKEN.

[stslex]

2026-08-21 audit against dev e0ada8f: still open. PUSH_TOKEN remains in cut_release.yml, sync_master_to_dev.yml, android_deploy_prod.yml, and the disabled beta workflow. No create-github-app-token step or App credential path is present. Release impact: not a functional app blocker, but still a high-blast-radius release-pipeline security and continuity risk.