feat(ipr): cross-repo callable workflow + GitHub App support

[bokelley]

Summary

Phase 1 of Batch C: enable AAO repositories beyond adcp to write back to the central IPR signature ledger via a GitHub App installation token. After this lands and the App is verified working in adcp itself, four follow-up PRs (one per downstream repo) add the tiny caller workflows.

What's in this PR

1. LEDGER_DIR env var in scripts/ipr/check-and-record.mjs so the script can run against a checked-out clone of the central ledger rather than cwd. Defaults to cwd — adcp's own workflow keeps working unchanged.
2. Reusable callable workflow at .github/workflows/ipr-check-callable.yml. Downstream repos invoke it via:

   uses: adcontextprotocol/adcp/.github/workflows/ipr-check-callable.yml@main
   secrets:
     IPR_APP_ID: ${{ secrets.IPR_APP_ID }}
     IPR_APP_PRIVATE_KEY: ${{ secrets.IPR_APP_PRIVATE_KEY }}

   The callable mints the App token, checks adcp out into .ipr-ledger/, runs the script. PR comments + status check stay on the event repo via its default GITHUB_TOKEN.
3. Concurrency alignment: adcp's existing workflow now uses the same adcp-ipr-signature-write group as the callable, so signatures from any repo serialize against each other.
4. Setup docs at governance/ipr-bot-setup.md — App configuration, secret rotation, revocation procedure, per-repo adoption checklist.

Pre-requisites (already done by @bokelley)

• AAO IPR Bot GitHub App created in adcontextprotocol org
• App installed on the 5 AAO repos with Contents:RW + Pull-requests:W + Statuses:W + Metadata:R
• IPR_APP_ID and IPR_APP_PRIVATE_KEY stored as org-level secrets, scoped to those repos

Test plan

• node --check scripts/ipr/check-and-record.mjs — script parses
• Smoke test the script with a no-op event payload — runs and exits clean
• After merge: open a test PR in adcp from a non-signed account; verify ipr-check goes through the existing path (LEDGER_DIR defaults work; no behavior change)
• After merge: roll out the caller workflow to ONE downstream repo first (suggest adcp-client) and verify a real PR-level signature lands in adcp@main:signatures/ipr-signatures.json
• Then roll to the remaining three

Follow-ups still queued

• Four small per-repo PRs adding the caller workflow to adcp-client, adcp-client-python, adcp-go, creative-agent. I'll open these as draft PRs once this PR is reviewed so the test order is controlled.
• Branch protection on main requiring IPR Policy / Signature (separate ops PR — needs to be coordinated with the cross-repo rollout so we don't lock out our own bot before it works).
• Dismiss CodeQL alerts 1306/1307 (UI-only, separate from this PR).

🤖 Generated with Claude Code