safety: introduce a permission-scoped GitHub App identity (replace personal PAT)

[lorenzoliuzzo]

Part of the fleet milestone (#1 §4).

Gap

Every tool acts under the personal PAT via the gh CLI — mythings/github.py
has no App/token-scoping logic. ARCHITECTURE.md names a permission-scoped
GitHub App as the intended identity model. Today a bug in any tool has the
same blast radius as the human account, and the fleet already runs concurrent
--execute workers against real accounts.

Do

• Register a MyThingsLab GitHub App with least-privilege scopes (contents,
  PRs, issues; no admin).
• Give mythings/github.py an App-token path (installation token) behind
  the same Runner seam.
• Migrate the fleet to the App identity for --execute.

Acceptance

Fleet can open PRs/issues under the App, PAT no longer required for headless runs.
Highest-value once MyCoder makes unattended code-writing real.

[lorenzoliuzzo]

Scoped this while working the rest of the safety milestone (#6, #8, #9, #10 — all closed). Didn't touch this one: registering a GitHub App is an org-owner action in the GitHub web UI (App creation, private key generation, org-level installation) that only a human can take — not something to do unattended from a headless session, and this issue is already correctly labeled needs-decision.

What's ready to go once the App exists, so it's not a blank slate:

• mythings/github.py's Runner seam (Callable[[list[str]], str], currently _gh() shelling out to the ambient gh auth login identity) is exactly the right seam for this. An App-token Runner would: exchange the App's private key + installation ID for a short-lived installation access token (POST /app/installations/{id}/access_tokens, JWT-signed with the private key), then invoke gh with GH_TOKEN=<installation token> instead of the personal auth.
• That's a self-contained addition to my-things-core (new Runner factory, e.g. github_app_runner(app_id, installation_id, private_key)), swappable in behind the existing seam without touching any calling tool.
• Migrating fleet_dispatch.py / the rest of the fleet to use it is then a one-line change per entry point (construct GitHub(runner=...) with the App runner instead of the default).

Manual prerequisites only you can do, in order:

1. Register the App in org settings (least-privilege scopes: contents, PRs, issues — no admin), install it on the org's repos.
2. Store its ID + private key somewhere the fleet can read at runtime without committing them (e.g. gh secret set, or a local file outside git — never in the ledger or a PR body, see safety: add a secret-leak check on ledger/PR content #9's secret-leak tripwire).

Happy to build the Runner implementation once those two exist — ping the issue or hand me the App ID/installation ID and I can wire it in.

[lorenzoliuzzo]

Update: App registered and Runner shipped.

• App registered (id 4260739), installed on the MyThingsLab org (installation 145558758), least-privilege scopes (contents/issues/PRs: write, metadata: read, no admin) — confirmed via a real minted installation token.
• safety: add a GitHub App installation-token Runner (mythings.github) my-things-core#82 merged: mythings.github.github_app_runner(app_id, installation_id, private_key_path) behind the existing Runner seam, verified end-to-end against the real App (not mocked).

Still open: migrating fleet_dispatch.py's own direct gh calls (and the rest of the fleet's GitHub() construction sites) from the ambient personal PAT to this Runner, and retiring the PAT for headless --execute runs — that's the remaining "Do" item and the actual acceptance bar ("PAT no longer required for headless runs"). Left as a follow-up rather than bundled into the core PR.

[lorenzoliuzzo]

Done — all pieces merged and verified on main:

• App registered (id 4260739), installed on the MyThingsLab org (installation 145558758), least-privilege scopes (contents/issues/PRs: write, metadata: read, no admin).
• safety: add a GitHub App installation-token Runner (mythings.github) my-things-core#82 + #83: mythings.github.github_app_runner/github_app_token behind the existing Runner seam.
• safety: migrate fleet_dispatch.py to the GitHub App identity #34: fleet_dispatch.py migrated -- --app-id/--app-installation-id/--app-private-key mint one GH_TOKEN near the top of main(), which covers fleet_dispatch's own gh calls and every dispatched worker's gh commands for free (both inherit process environ). Omitting the flags leaves PAT-based behavior untouched.

Re-verified end-to-end just now against a fresh main checkout: a live run authenticated as the App and the orchestrator's own gh-backed ranking found the same real candidates as under the PAT.

Closing.