Authenticate generated sync pull requests

[bigboateng]

Summary

• mint an Operator Stack Publisher token inside the downstream sync workflow
• use the App identity specifically when opening generated upstream pull requests
• retain the repository token for checkout and branch push
• preserve the existing Boatstack credential-name fallback during the Publisher rename
• add a distribution-contract test preventing regression to github.token for PR creation

Why

The end-to-end setup test successfully dispatched Intelligence Flow into Value Map, but the generated pull request had no checks. GitHub intentionally suppresses follow-on workflow events when a pull request is created with the repository GITHUB_TOKEN.

Creating the pull request as Operator Stack Publisher gives the sync a non-recursive external identity, allowing Value Map's normal pull-request CI to verify Linux, macOS, and Windows before merge.

Verification

• python3 -m unittest discover -s tests -v
• git diff --check
• live Publisher dispatch created Value Map PR Sync Value Map from Intelligence Flow 717c7b1a9491 #2 and confirmed the prior missing-check behavior
• after merge, the end-to-end dispatch will be repeated to verify generated PR checks