ci(repo-assist): mint App token for safe-outputs and CI triggering

Wire a GitHub App into safe-outputs so all bot operations (PR creation,
branch pushes, comments, labels) run under an installation access token
instead of GITHUB_TOKEN. Two effects:

1. Commits and PR-creation events authored by the App actually trigger
   downstream workflows (Lint PR, build); commits authored by GITHUB_TOKEN
   are silently suppressed by GitHub Actions to prevent recursion. This
   is what caused PR #4560 to land on main with a non-conventional title:
   Lint PR never ran. Now it will.
2. Bot activity is attributed to the App identity rather than to whichever
   identity GITHUB_TOKEN is acting as, which is clearer in commit history.

Also sets `github-token-for-extra-empty-commit: app` on
`create-pull-request` and `push-to-pull-request-branch` so the post-create
empty-commit trick uses the App token; this covers the case where the
target workflow only listens for `synchronize`/`push` events rather than
`opened`.

Requires repo to have `vars.APP_ID` and `secrets.APP_PRIVATE_KEY` set
(already configured).

Supersedes #4565 (PAT-based variant).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dbrattli

.github/aw/actions-lock.json

@@ -5,10 +5,10 @@
       "version": "v9.0.0",
       "sha": "d746ffe35508b1917358783b479e04febd2b8f71"
     },
-    "github/gh-aw-actions/setup@v0.69.1": {
+    "github/gh-aw-actions/setup@v0.68.3": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.69.1",
-      "sha": "b2d32ac2825a5c57cb99851c2ca00094d5e131a6"
+      "version": "v0.68.3",
+      "sha": "ba90f2186d7ad780ec640f364005fa24e797b360"
     },
     "github/gh-aw/actions/setup@v0.69.1": {
       "repo": "github/gh-aw/actions/setup",