Provision the least-privilege bot GitHub App (sole trunk writer)

[ronimoe]

Context

bootstrap/ruleset.json bypass_actors expects an App installation id. The App is the sole privileged identity and sole trunk writer (avoids the GITHUB_TOKEN no-retrigger trap and keeps the audit trail distinct from agents).

Scope

• App manifest (contents/PRs/checks/issues write); install flow.
• Wire the installation token into the engine and governance-setup.sh (set the real actor_id).

Acceptance

conductor setup sets the real app id; the engine advances trunk authored as the App.

Seam

tools/conductor/bootstrap/, ruleset.json.

[ronimoe]

Implemented in ddd23b3.

ghapp.py mints a GitHub App installation token via an RS256 JWT signed by openssl (no Python crypto dependency) exchanged through curl. Unit-tested incl. a real openssl sign→verify roundtrip and the JWT header/payload shape. bootstrap/app-manifest.json defines the least-privilege bot App; the workflows use the official actions/create-github-app-token.

Remaining (manual — cannot be automated from here): create + install the App, then set the repo Actions variable CONDUCTOR_APP_ID and secret CONDUCTOR_APP_PRIVATE_KEY. Steps in tools/conductor/INTEGRATION.md.