Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Prefer caller-provided GH_TOKEN/GITHUB_TOKEN for GitHub API/CLI calls while keeping github.token fallback for compatibility.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove github.token fallbacks from GitHub-facing composite actions so reusable workflow paths require explicit app-token env wiring.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Mint an installation token in Build-Module.yml (same pinned
actions/create-github-app-token@fee1f7d... as Plan and Publish-Module)
and inject it as GH_TOKEN on the Build-PSModule step.

This covers the three gh repo view calls in Build-PSModuleManifest.ps1
that read repo description, topics, and URL — all of which go through
the gh CLI and therefore consume GH_TOKEN.

The job-level GH_TOKEN: github.token fallback is removed.
workflow.yml is updated to pass the GitHubAppClientId and
GitHubAppPrivateKey secrets into the Build-Module reusable workflow.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Each token-minting step now requests only the permissions the job
actually exercises and restricts the token to the current repository.

Plan:
  repositories: current repo
  permission-contents: read   (gh release list in Resolve-Version)
  permission-pull-requests: write (label/comment via Get-PSModuleSettings)

Publish-Module:
  repositories: current repo
  permission-contents: write  (gh release create/upload/delete)
  permission-pull-requests: write (gh pr comment)

Build-Module:
  repositories: current repo
  (no permission-* needed - only gh repo view which uses metadata:read,
   auto-granted to all GitHub App installations)

This limits blast radius: even if a compromised step obtained GH_TOKEN,
it could only act on the one repository and only with the declared
permission level, not on every repo in the installation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Map Shelly's repository secrets into the generic GitHub App reusable-workflow contract in the test callers and documented example.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

## Summary
- port the durable GitHub App authentication guidance into the
Process-PSModule canonical docs tree
- document the required `GitHubAppClientId` / `GitHubAppPrivateKey`
reusable-workflow boundary and caller mapping
- document the Plan, Build-Module, and Publish-Module repository scope,
minimum permissions, and step-scoped `GH_TOKEN` injection implemented by
#408

## Stack
- Stacked on #408 (`github-app-planning`)

## Validation
- `git diff --check`

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Distinguish the GitHub App installation permissions from caller github.token permissions and document the Dependabot private-key trust boundary.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Nest the Markdown line-length setting under MD013 so Super-Linter applies the repository limit to generated help files.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Make PSGALLERY_API_KEY explicit across Process-PSModule documentation while retaining the Publish-PSModule action input name as APIKey.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Rename the Publish-PSModule action input and environment variable to PSGALLERY_API_KEY while retaining the PowerShell cmdlet parameter name.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Identify the pinned actions/create-github-app-token release as v3.2.0 in workflow and documentation references.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Keep GitHub App and publishing credential guidance in the canonical documentation tree instead of the repository root README.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>