fix: github-app auth support in SideRepoOps maintenance workflow generator

[Copilot]

When a source workflow uses github-app: for cross-repo checkout auth, the generated agentics-maintenance-<owner>-<repo>.yml silently fell back to ${{ secrets.GH_AW_GITHUB_TOKEN }} — a secret App-only consumers never set — causing 100% failure on every scheduled run.

Changes

pkg/workflow/side_repo_maintenance.go

• SideRepoTarget: add GitHubApp *GitHubAppConfig field (mutually exclusive with GitHubToken, matching CheckoutConfig)
• collectSideRepoTargets: replace tokenByRepo map[string]string with a sideRepoAuth struct tracking both token and app config; first-seen auth wins, later occurrences upgrade only from "no auth" → "has auth"; logs when a conflicting later auth is ignored
• effectiveSideRepoToken: returns ${{ steps.side-repo-app-token.outputs.token }} when GitHubApp != nil
• sideRepoAppTokenMintStepYAML: new helper that builds the create-github-app-token step YAML by delegating to the existing buildGitHubAppTokenMintStepWithMeta infrastructure
• generateSideRepoMaintenanceWorkflow: injects the mint step as the first step of each cross-repo job (close-expired-entities, apply_safe_outputs, create_labels, activity_report) when app auth is configured; validate_workflows keeps GITHUB_TOKEN (own-repo only)

Example

A source workflow like:

checkout:
  - repository: microsoft/aspire.dev
    github-app:
      app-id: ${{ secrets.ASPIRE_BOT_APP_ID }}
      private-key: ${{ secrets.ASPIRE_BOT_PRIVATE_KEY }}
      owner: "microsoft"
      repositories: [aspire.dev, aspire]
    current: true

now generates maintenance jobs with:

    steps:
      - name: Generate GitHub App token
        id: side-repo-app-token
        uses: actions/create-github-app-token@...
        with:
          client-id: ${{ secrets.ASPIRE_BOT_APP_ID }}
          private-key: ${{ secrets.ASPIRE_BOT_PRIVATE_KEY }}
          owner: microsoft
          repositories: |-
            aspire.dev
            aspire
          github-api-url: ${{ github.api_url }}
      - name: Apply Safe Outputs
        ...
        with:
          github-token: ${{ steps.side-repo-app-token.outputs.token }}

${{ secrets.GH_AW_GITHUB_TOKEN }} is preserved as the fallback only when neither github-token: nor github-app: is configured.

Tests

• Unit tests for collectSideRepoTargets covering app config collection, upgrade-from-nothing, and first-seen-wins semantics
• Unit tests for all three effectiveSideRepoToken paths
• Integration test: App auth flow (verifies mint step, credentials, token in github-token: and GH_TOKEN:, ordering)
• Integration test: App auth + expires combo (verifies close-expired-entities also receives the mint step)

[github-actions]

🤖 PR Triage — Run §28715668077

Field	Value
Category	bug
Risk	🟡 Medium
Score	60/100
Impact	30/50
Urgency	20/30
Quality	10/20
Action	batch_review
Batch	pr-batch:go-bugfix

Fixes github-app auth in SideRepoOps maintenance workflow generator. +90/-15 Go logic, +122+170 test lines. Medium risk (auth path). Batch with go-bugfix group.

Generated by 🔧 PR Triage Agent · 113.5 AIC · ⌖ 13 AIC · ⊞ 5.5K · ◷