feat(2036): the remaining board writers authenticate as the App, tranche 3

[LukasWodka]

Refs #2036. Third tranche — the board writers that also need issues: write.

workflow	sites	what it writes
kanban-closure-router	3	card + sibling-merge label + closure comment
fr-pass-comment	2	card + outcome comment + 👍/👎 reaction
kanban-reconcile	1 → 6	card moves, archives, keep-open shield
customer-priority-bump	1	priority label on the issue

These need issues: write as well as organization_projects: write, which is why they weren't in tranche 1 — the App only gained it after tranche 2.

add-to-kanban is deliberately not here

It is a copy, not a reusable — duplicated byte-for-byte into all 19 repos, with caller-drift comparing blob shas against .github's copy. Migrating it is a 19-PR sweep where every other repo must merge before .github, or the org audit goes red on main until the last one lands. That earns its own tranche.

Three stale prose references fixed in the same change

Leaving these would be the exact defect this epic is about — a document describing behaviour the code no longer has.

1. The MIN_SCOPE guard's error message told operators to "Check PROJECTS_KANBAN_TOKEN still has org-wide contents:read" — remediation for a credential this workflow no longer uses. It now names the App and the new failure mode: an App is installed on selected repos, so a repo added to the org but never added to the installation reads as absent exactly the way an exhausted PAT did.
2. "the PROJECTS_KANBAN_TOKEN write rule" → "the board-write rule". A rule named after a secret goes stale the moment the secret does.
3. The counted-not-fatal rationale cited the shared 5,000/hr PAT budget as the likeliest cause of a 403. The App removes that cause but not the class — the comment now says which part changed and which didn't.

kanban-reconcile's env move

GH_TOKEN moves from job-level to the six steps that actually call gh. A job-level env can't read a step output, and the upside is that three of its nine steps never needed a credential and no longer carry one.

What's still on the PAT after this

add-to-kanban (copy sweep) · fr-gate (its own tranche, last) · the four audits caller-drift / standards-sync / merge-settings-drift / bricked-prs.

fr-gate goes last on purpose: it's a required check on every promotion, so if its board reads break, the train that would carry the fix is the broken thing. skip-fr-gate is the escape hatch, and that's worth knowing before it's needed.

Verification

actionlint clean on all four · all four parse · kanban-columns selftest 10/10 · caller-drift selftest 176/176 · no GH_TOKEN in these files resolves to the PAT.

Same limit as before: callers pin @main and this is develop, so merging is inert fleet-wide until .github promotes. fr-pass-comment and kanban-closure-router are event-driven and kanban-reconcile is a cron — none is exercised by a PR check, so CI green here is lint-and-parse strength, not proof.

---

Note

Medium Risk
These workflows drive live kanban moves, issue labels, and /fr-pass reporting; a misconfigured App installation or missing issues: write would break automation org-wide, though the deliberate lack of PAT fallback makes failures visible rather than silent.

Overview
Tranche 3 of backend#2036 moves the remaining board workflows that need both organization_projects: write and issues: write off the shared human PAT onto the tracebloc-release-train GitHub App.

Each of customer-priority-bump, fr-pass-comment, kanban-closure-router, and kanban-reconcile adds a Mint an installation token step (actions/create-github-app-token with RELEASE_TRAIN_APP_* secrets and owner: ${{ github.repository_owner }} for org-scoped ProjectV2 access). Every former GH_TOKEN: ${{ secrets.PROJECTS_KANBAN_TOKEN }} site now uses ${{ steps.app-token.outputs.token }} only—no PAT fallback, so a broken App path cannot masquerade as a successful migration.

In kanban-reconcile, GH_TOKEN is removed from job-level env and set on the six steps that call gh, since job env cannot reference the mint step output. kanban-closure-router also wires the App token into the Determine target Status step (alongside the update/label steps), enabling the cross-repo closer GraphQL lookup that previously had no token.

Operator-facing comments are refreshed: MIN_SCOPE errors now point at App installation coverage and contents:read; PROJECTS_KANBAN_TOKEN write rule wording becomes the credential-neutral board-write rule; the sibling-merge counted-not-fatal note explains App installation gaps as the new 403 class after the PAT budget cause is gone.

^{Reviewed by Cursor Bugbot for commit 8557d36. Bugbot is set up for automated code reviews on this repo. Configure here.}