feat(ci): mint an App token for the presentation-branch refresh

[nolte]

Summary

Refreshing main under GITHUB_TOKEN cannot work at all. GitHub rejects a push
from a GitHub App identity that creates or updates any file under
.github/workflows/ unless the installation holds the workflows permission —
and GITHUB_TOKEN is such an identity. Forward the portfolio App credentials so
the reusable mints a short-lived installation token for the push instead.

Changes

• Forward app-id: ${{ vars.PORTFOLIO_APP_ID }} and
  secrets.app-private-key: ${{ secrets.PORTFOLIO_APP_PRIVATE_KEY }} to
  reusable-release-cd-refresh-master.yml.
• Replace the deferral comment at the call site with the established reason and
  the permission set the installation must hold.

Linked issues

None

Testing

• task --yes lint — all pre-commit hooks pass.
• python3 -c "yaml.safe_load(...)" — parses; the job now carries
  secrets: [token, app-private-key] and with: [target_branch, from_branch, app-id], matching the reusable's declared signature at d51e51e.
• Established, from run
  https://github.com/nolte/taskfiles/actions/runs/32065009956 dispatched right
  after fix(ci): make the refresh-master manual dispatch usable #43: FROM_REF: v0.1.5 resolved correctly and the push was attempted,
  then rejected with refusing to allow a GitHub App to create or update workflow .github/workflows/release-cd-refresh-master.yml without 'workflows' permission.
• Established, git diff --name-only origin/main 57450b5 -- .github/workflows/:
  seven workflow files differ between main and the release tag, so the reset
  necessarily writes under .github/workflows/.
• Established, gh api repos/nolte/taskfiles/branches/main/protection → 404 Branch not protected: the rejection is not a branch-protection effect.
• Established, GitHub Docs workflow-syntax §permissions: the settable scope
  list carries no workflows entry, so no permissions: change can grant it.
• Not established — this is the merge gate. Whether the installation behind
  PORTFOLIO_APP_ID (3784868) holds contents: write and workflows: write
  on this repository. gh api /user/installations returns 403 without App
  authentication, so it can only be read from the App's settings page.

Risk / rollout notes

Medium, and gated. The change swaps the push identity on both the automatic
release: published path and the manual dispatch path.

• If the installation holds both permissions, the refresh works for the first
  time and main catches up.
• If the mint fails outright (App not installed), the reusable's
  continue-on-error falls back to secrets.token and behaviour is exactly
  today's — still broken, no worse.
• If the mint succeeds but a permission is missing, there is no fallback and
  the push fails. This is why the PR stays draft until the installation
  permissions are confirmed.

Second effect, deliberate: App-token pushes do cascade downstream, which is the
point of the remediation. build-static-tests.yaml triggers on an unfiltered
on: push:, so each successful refresh of main will additionally start
pre-commit, trivy and chain-bench there, and automerge.yaml triggers on
check_suite. If that noise is unwanted, the fix is a branch filter in
build-static-tests.yaml, not reverting this.

The platform constraint behind this PR is recorded portfolio-wide in
nolte/claude-shared#550, spec/project/workflow-health/ §Known platform
constraints.

Originating source: workflow-health triage of the red release-cd-refresh-master.yml run https://github.com/nolte/taskfiles/actions/runs/32065009956
Dispatched specialist: no matching specialist existed — generalist handled