feat(workflow): bot-pushed commits should retrigger downstream CI

[heskew]

Summary

git push from the agent step uses the default GITHUB_TOKEN. Per GitHub's loop-prevention rule, commits pushed under that identity don't fire downstream workflows. Result: bot-authored PRs sit with stale CI on the prior SHA — Format Check, Unit Tests, Integration Tests, and validate / validate all silently skip the bot's commit. Hit on harper #490 today.

Fix: mint a write-scoped installation token from the existing HarperFast AI Workflows App and pass it to actions/checkout's token: input. git push then runs as the App identity, and that IS allowed to trigger downstream workflows.

Applied to _claude-mention.yml and _claude-issue-to-pr.yml. Review reusable doesn't push commits, unchanged.

Permission prereq before merge

Warning

The HarperFast AI Workflows App currently has Members: Read only. This change requires:

• Contents: Write on consumer repos (for git push)
• Pull requests: Write (for the agent's gh pr create)

Without the upgrade, the mint step will fail and the agent can't push at all. Don't merge this PR until the App permissions are upgraded — otherwise the next consumer pin bump breaks the bot-authoring path entirely.

App settings → Permissions → bump → review and accept the install-permission prompts on each consumer repo.

Test plan

• Validator passes against all three reusables.
• yq parses both modified files cleanly; new step ordering looks correct (mint → checkout → existing flow).
• Before merging: upgrade App permissions per above.
• After merge + consumer pin bumps: open a fresh @claude mention or claude-fix:* label run; verify the agent's commit fires Format / Unit / Integration / validate / validate checks (currently they silently skip).

Sibling PR

The :test-runs-format-check fix split into its own PR for faster ship — no permission prereq there.

🤖 Generated with Claude Code