chore: automate cross-repo PAT rotation (APISPY_DISPATCH_TOKEN / SPEQL_READ_TOKEN)

[goldjg]

Background

The cross-repo shard pipeline uses two fine-grained PATs with 90-day expiry:

• \APISPY_DISPATCH_TOKEN\ — stored in UndREST-SpecQL secrets; used to trigger
  epository_dispatch\ on UndREST-APISpy
• \SPEQL_READ_TOKEN\ — stored in UndREST-APISpy secrets; used to download release assets from UndREST-SpecQL

These need manual renewal every 90 days.

Options

Option A — GitHub App (recommended)

Replace both PATs with a GitHub App installed on the UndREST-Labs org. Apps generate short-lived tokens (1hr) automatically — no rotation needed.

Option B — Automated PAT rotation workflow

A scheduled workflow that regenerates the PATs via the GitHub API and updates the secrets in both repos. Requires one long-lived bootstrap token.

Acceptance Criteria

• Cross-repo shard pipeline works without manual secret rotation
• Rotation (or token generation) is auditable
• Both repos updated to use the new auth mechanism