Use GitHub App deployment tokens and update model-access tests

[ebhills]

Linked issue

Related to #1117. This delivers the cross-repository deployment authentication slice; the broader lifecycle work remains open.

What changes

DEV schema publishing and Lambda DEV/PROD dispatch now use the organization-owned Wrangleworks Deployments GitHub App instead of CROSS_REPO_PAT_V2. Each operation receives a short-lived token restricted to its target repository and required permission. Early checks validate configuration and installation access before tests or package publishing, and publishing/dispatch jobs generate fresh tokens immediately before use.

Schema commits use the GitHub Actions bot identity. The setup guide documents the existing App and installation, required Actions configuration, DEV validation, and key rotation.

The train.lookup missing-model test now uses mocked HTTP responses to cover missing models (404) and inaccessible models (403) separately. It asserts the exact exception type and recipe-context message and verifies that no model update occurs. Runtime behavior is unchanged.

How it was verified

• 11 focused offline tests passed: .venv/Scripts/python.exe -m pytest tests/connectors/test_train.py::TestTrainLookup::test_update_model_access_errors tests/test_data.py -q.
• Both changed workflows passed actionlint 1.7.12 (external shellcheck/pyflakes disabled) and structural checks preserving existing triggers, jobs, gates, permissions, and outputs.
• Verified all six token-generation steps use the pinned official action and narrow repository/permission scope.
• Executed eight missing/present configuration cases without printing configuration values.
• Live App authentication successfully issued a Contents-write token restricted to wrangleworks.github.io and an Actions-write token restricted to Lambda-Recipes. Repository/workflow metadata reads passed, and both temporary tokens were revoked.
• Verified the configured DEPLOY_APP_CLIENT_ID and saved DEPLOY_APP_PRIVATE_KEY in WranglesPY Actions.
• git diff --check passed; the branch was current with main at publication.

These live checks did not publish a schema, dispatch a workflow, or deploy DEV/PROD. New PR CI is pending; the previous full pipeline was not rerun.

Compatibility and risk

No recipe or runtime API changes. Existing test/publishing gates, downstream main refs, initiating-user attribution, and AWS OIDC remain unchanged. The workflows have no PAT fallback. Successful token issuance does not prove a later schema push will satisfy repository branch rules.

After merge, start a new Deploy Dev run from main, using the intended version base (currently 1.20.2). An old failed run retains its old workflow definition. Verify schema publication, RC publication, and the downstream Lambda image/update before calling DEV deployment complete.

The separate prior container failure in test_extract_custom_ai_multiple_output remains unresolved. It expects successful extraction and received 403: API Key not setup correctly; it has no stale error assertion to update. This PR preserves that integration test pending verification of its model-scoped credential configuration.

Existing deployed images are unaffected. If deployment fails, keep the current image while correcting App configuration; reverting the migration also requires restoring a working previous credential route. Retire shared PAT secrets only after checking their other consumers.

Ready-for-review checklist

• One human delivery owner is assigned (@ebhills)
• The linked issue and intended milestone are correct (related to Complete and harden the main-based PR, dev deployment, and release lifecycle #1117; no release milestone assigned)
• The branch is current with main and has no merge conflicts
• Focused tests pass
• New or changed behavior has direct test coverage
• Documentation/schema/configuration is updated where applicable
• The PR contains no unrelated changes
• The PR description reflects the branch's current scope and latest validation
• One primary reviewer is requested only when this PR is ready

See the pull request workflow.