fix(workflow): use app token for gh variable set — GITHUB_TOKEN lacks permission (#7771)

## Summary

Fix `ci-poller.yml` failing with `HTTP 403: Resource not accessible by
integration` when calling `gh variable set CI_POLLER_HAS_PENDING`.

Failing run:
https://github.com/getsentry/publish/actions/runs/24263308562/job/70852292016

## Root Cause

`GITHUB_TOKEN` cannot write repo variables through the Actions Variables
API, even with `actions: write` in the workflow permissions block. The
sentry-internal-app token has admin access and can write variables.

PR #7768 incorrectly assumed the opposite (that the app token lacked
permission and `GITHUB_TOKEN` had it).

## Changes

- `ci-poller.yml`: "Disable poller" step uses app token instead of
`GITHUB_TOKEN`
- `ci-pending.yml`: "Enable cron poller" step uses app token instead of
`GITHUB_TOKEN`
- Remove unnecessary `actions: write` from both workflow permission
blocks

Author: BYK

.github/workflows/ci-pending.yml

@@ -7,7 +7,6 @@ on:
 permissions:
   contents: read
   issues: read
-  actions: write
 
 jobs:
   mark-pending:
@@ -33,8 +32,8 @@ jobs:
 
       - name: Enable cron poller
         env:
-          # Use GITHUB_TOKEN (with actions:write) for variable access —
-          # the app token may not have the actions_variables permission.
-          GH_TOKEN: ${{ github.token }}
+          # Use the app token — GITHUB_TOKEN cannot write repo variables
+          # (403 "Resource not accessible by integration").
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true"

.github/workflows/ci-poller.yml

@@ -7,7 +7,6 @@ on:
 permissions:
   contents: read
   issues: read
-  actions: write
 
 jobs:
   check-ci:
@@ -140,16 +139,16 @@ jobs:
             fi
           done
 
-      # Disable the poller if no ci-pending issues remain. Uses GITHUB_TOKEN
-      # (with actions:write) since the app token may lack actions_variables
-      # permission.
+      # Disable the poller if no ci-pending issues remain.
       # Note: there's a small race window where ci-pending.yml could set the
       # variable to "true" right before we set it to "false" here. In that case
       # the new issue waits at most one cron tick (5 min) — ci-pending.yml will
       # set the variable again on the next issue:opened event if needed.
       - name: Disable poller if no pending issues remain
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Use the app token — GITHUB_TOKEN cannot write repo variables
+          # (403 "Resource not accessible by integration").
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           remaining=$(gh issue list -R "$GITHUB_REPOSITORY" \
             --state open \