ci: AUT-1408 replace cicd PAT with GitHub App tokens

[svcnemo-autobot]

Background

cicd-main used the long-lived secrets.PAT credential for container builds, tests, and coverage statuses.

What changed

Mint per-job GitHub App tokens from vars.BOT_ID and secrets.BOT_KEY, then pass them to all six existing consumers.

Details

flowchart LR
  ID[BOT_ID] --> Token[Mint app token]
  Key[BOT_KEY] --> Token
  Token --> Build[Build]
  Token --> Tests[Tests]
  Token --> Coverage[Coverage]

Loading

The token action is pinned to immutable v3.2.0. Existing local action input names remain unchanged.

Tested

• Workflow YAML parsing and per-job token-order assertions
• Verified 6 token steps and zero secrets.PAT references
• git diff --check
• Full pre-commit lint hooks passed; the all-files run remains blocked by unrelated existing EOF and underscore-named Markdown findings

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[svcnvidia-nemo-ci]

/ok to test c342480