Require GitHub App auth for automation workflows

[adampoit]

Summary

• generate short-lived GitHub App tokens for sync and promotion workflows instead of pushing with GITHUB_TOKEN
• validate App token wiring, permissions, Actions enablement, and repository credential metadata in patchlane doctor
• add patchlane verify-auth to dispatch and watch a correlated no-push sync
• document the required App permissions and setup flow in the manual, migration guide, examples, and setup skill

Why

GitHub suppresses most workflow events caused by the built-in GITHUB_TOKEN. Although it can push Patchlane's generated branches, those pushes do not reliably start integration CI or the subsequent promotion workflow. The workflows also did not pass GH_TOKEN to the GitHub CLI.

The generated workflows now use an installation token with explicit Contents, Workflows, and optional Issues permissions. App-authored pushes trigger the expected workflow chain.

Validation

• npm test (47 tests)
• npm run format:check
• npm run artifacts:check
• changed-file LSP diagnostics

[not-adam]

Mira PR Walkthrough

This PR enhances the patchlane doctor diagnostics to enforce GitHub App-based authentication in automation workflows. It adds validation that sync/promotion workflows use an App installation token (via actions/create-github-app-token@) with correct permissions, and verifies that the required App credentials (client ID variable and private key secret) are configured in the repository's Actions metadata. Comprehensive unit tests cover all new validation paths including error conditions and API failure fallbacks.

Confidence: 4/5   ◉◉◉◉○   Safe with minor fixes

• Changes are well-scoped to doctor diagnostics only, with thorough test coverage; no breaking changes to existing behavior.

Blast Radius — 2 dependent repositories, 3 total references

adampoit/mira — 1 reference
adampoit/wezterm — 2 references

2 files reviewed

---

Comment @not-adam help to get the list of available commands and usage tips.

[not-adam]

Mira Review Summary

The src/doctor.ts file introduces new doctor checks and automation validation logic without corresponding test coverage, flagged at line 432. Adding tests for this module would improve maintainability and help catch regressions as the GitHub App authentication workflows evolve.