* fix(blog-autopublish): use App-minted token instead of GITHUB_TOKEN

Org policy "Allow GitHub Actions to create and approve pull requests"
is disabled, which silently kills `gh pr create` calls authed with
GITHUB_TOKEN. The cron has been failing for two days running (#43, #45)
with "GitHub Actions is not permitted to create or approve pull
requests" — three scheduled posts (overdoing-the-verification-chain,
variant-pruning-rust-mcdc, cross-language-lto) sat as drafts.

Mint a token from the PulseEngine Actions Helper App
(actions/create-github-app-token@v1) using the ACTIONS_BOT_APP_ID and
ACTIONS_BOT_PRIVATE_KEY repository secrets. The App's installation
grants Contents R/W + Pull requests R/W + Metadata R on this repo
only — strictly narrower than what the org-disabled GITHUB_TOKEN
would have had.

App-minted tokens authenticate as the App, not as Actions, so the
org-level restriction stays intact for the default token while this
single workflow has the explicit grant it needs.

Five surgical changes:
- New "Mint App token" step before checkout
- actions/checkout@v4 takes the App token (so credential helper uses it for `git push` later)
- Four env: GH_TOKEN swaps (Ensure labels exist, Publish ready posts, Post / update status comment, Open failure issue)

The existing permissions: block (contents/pull-requests/issues: write)
stays as-is for clarity / defense in depth, even though we no longer
use the default GITHUB_TOKEN in this job.

Token expires in 1 hour; workflow timeout is 15 min, so no rotation
logic needed.

Trigger workflow_dispatch after merge to flush the three stuck posts
in one run.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* publish: ship 3 stuck posts manually (cron blocked behind App-token PR)

The autopublish cron has been blocked by org policy disallowing
GITHUB_TOKEN PR creation. The fix (App-minted token) is in PR #46 but
its CI is stuck queued. To not delay shipping further, flip draft
manually on the 3 posts that should have published 2026-04-29 / 30 / 05-01:

- overdoing-the-verification-chain (was due 2026-04-29)
- variant-pruning-rust-mcdc (was due 2026-04-30)
- cross-language-lto-three-quiet-barriers (was due today, 2026-05-01)

Once PR #46 lands and the cron resumes, future posts publish on their
date with no manual flip.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>