Remove internal rollout context

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: tclem

.github/scripts/apply-dependency-update

@@ -144,12 +144,6 @@ fi
 title=$(tr -d '\n' < "$bundle_dir/title.txt")
 
 cat "$bundle_dir/body.md" > "$RUNNER_TEMP/pr-body.md"
-cat >> "$RUNNER_TEMP/pr-body.md" <<'EOF'
-
----
-
-This draft is a reference implementation using the workflow `GITHUB_TOKEN`. GitHub does not trigger new workflow runs from branch pushes or PR mutations made with that token, so a maintainer must trigger or approve CI. Fully autonomous post-PR repair requires a proven least-privilege GitHub App installation token or PAT scoped to the reserved dependency branches and their pull requests.
-EOF
 
 git checkout -B "$branch"
 git apply --index --binary "$bundle_dir/final.patch"

.github/scripts/generate-dependency-update

@@ -152,7 +152,7 @@ Make the smallest consumer repair justified by the validation log. Do not weaken
 - $agent_output_dir/title.txt: one concise single-line PR title.
 - $agent_output_dir/body.md: a compact PR body explaining why the update exists, the dependency/version changes visible in deterministic.diff, and concrete risk.
 
-Do not add a signature, credential discussion, reviewer request, validation or CI status section, or implementation recap; the trusted apply job adds the fixed operational footer.
+Do not add a signature, authentication discussion, reviewer request, validation or CI status section, or implementation recap.
 EOF
 )
 

.github/skills/update-deps/SKILL.md

@@ -24,7 +24,7 @@ The workspace has 14 Cargo manifests: the virtual root, eight published crates (
 
 `.github/workflows/update-dependencies.yaml` runs at the Thursday 06:17 UTC fleet slot. Its matrix is deliberately serial in this order: Cargo, npm, GitHub Actions.
 
-Rollout order matters: merge and observe this repository-local automation before the central Blackbird dependency combiner excludes `github/rust-gems`, so dependency coverage has no gap.
+Roll out this repository-local automation before removing any existing dependency-update coverage, so there is no gap.
 
 Each ecosystem run has two trust domains:
 
@@ -65,11 +65,9 @@ The Copilot CLI is started with `--add-dir .` so this project skill is loaded as
 - Never mark a PR ready, merge it, close superseded PRs, or request review. `CODEOWNERS` routes changes to `@github/blackbird-reviewers`.
 - Repair is bounded to three agent passes. Missing output, allowlist violations, failed final validation, and unexpected branch/PR state are explicit failures.
 
-## Credentials
+## Authentication
 
-The read-only generator uses `GITHUB_TOKEN` with `copilot-requests: write`, which bills Copilot usage to the organization. The writer currently uses the workflow `GITHUB_TOKEN` because no least-privilege PR-writer credential is proven for this repository.
-
-GitHub suppresses workflow events caused by `GITHUB_TOKEN`, so draft dependency PRs created by this reference implementation require a maintainer-triggered or approved CI run. Fully autonomous post-PR CI repair requires a least-privilege GitHub App installation token or PAT with only the contents and pull-request permissions needed for the reserved branches and PRs. Do not invent or name a secret until that credential exists.
+The read-only generator uses `GITHUB_TOKEN` with `copilot-requests: write`, which bills Copilot usage to the organization. GitHub write authentication belongs only to the separate trusted apply job and must never be exposed to the Copilot CLI.
 
 ## Validation commands