pin: stop using a token the scope assertion just rejected (#87)

[bdelanghe]

The caller half of #87. The broker half is infra#172.

1. Point at front-desk-pin, not front-desk

The mint step's own assertion settled #87's open question on the merge of #97:

GRANTED: {"organization_projects":"write","issues":"read","metadata":"read","pull_requests":"write"}
REQUIRE: contents, pull_requests   ->   contents(granted: absent)

Broker registry, not the App installation. And the fan-in entry cannot simply be given contents: it is deliberately unpinned, contents is privileged (infra#140), so the broker would refuse the entry outright and take every other consumer with it. infra#172 adds a separate entry pinned to this workflow instead.

2. Don't use a token the assertion just rejected

This is the part worth reading. require: contents, pull_requests (#93) worked exactly as designed — it reported contents(granted: absent) and named both places the gap could live, which is why diagnosing this took minutes instead of the half-day #87 describes.

Then continue-on-error: true swallowed the verdict, the job used the token anyway, and died on the very push the assertion had just said would fail:

remote: Permission to bounded-systems/.github.git denied to bounded-systems-front-desk[bot]
fatal: ... 403        exit code 128

An assertion whose verdict nothing consumes is decoration. The token is now used only when the mint step actually succeeded.

The fallback is not a downgrade. github.token holds contents: write here — see the job's own permissions: block — and pushed this exact branch fine before the broker was wired in (#79). So on a scope gap the branch now lands with the correct pin and only opening the PR is lost. That is a click, versus the full hand-regenerate it costs today. Four of those so far: #79, #86, #89, #98.

A third annotation distinguishes "broker reachable, scopes insufficient" from "broker unreachable", because the two are fixed in different systems and the existing message only described the second.

Ordering

Safe to land before the broker deploys. An unknown app 404s → the mint step fails → the job takes the github.token path above. Strictly better than today in every branch: today nothing is pushed at all.

Verification

• workflows.test.mjs: 27 pass — including the column-0 block-scalar check that the new elif prose could have tripped.
• Full .claude/ suite: 109 pass.

One thing I did not change

The else branch still says ``schema is required on this repo. #78's commit message records that it is not — `.github` is absent from the `ci-green` ruleset — but I could not verify the ruleset's current state from a session, and replacing one unverified claim with another seemed worse than leaving it. Flagging rather than silently editing.

---

Generated by Claude Code