fix: publish 61-org governance with scoped GitHub App credentials

[ORESoftware]

Audit finding

The trusted-main 61-organization governance publisher failed closed because its protected host did not receive the broad organization-administration credential expected by the legacy runner. The original App-only draft then failed full-history secret scanning because an early test commit contained a credential-shaped private-key fixture, even after the file was corrected at the tip.

This clean-history replacement is one commit on current main. It preserves the App-only design without carrying the rejected fixture in ancestry.

Changes

• mint a GitHub App JWT only from the protected App ID/private-key boundary;
• require an installation for every exact target organization, repository_selection=all, and the reviewed administration/contents/metadata permission set;
• complete the full 61-organization installation/repository preflight before the first mutation;
• mint short-lived installation tokens per organization and revoke every prepared/current token on success or failure;
• run the existing deterministic governance reconciler without a PAT fallback;
• emit a redacted 61-entry report and fail if any target is missing, duplicated, or unverified;
• retain exact r2g and r2g-test exclusions.

Safety

• no personal access token path exists;
• ambient GitHub token variables are removed before App credentials are read;
• the private key is never logged or written to artifacts;
• installation tokens are bounded by exact owner and required permissions;
• all 61 targets must pass preflight before mutation, preventing partial fleet rollout caused by a late missing installation;
• this branch is reconstructed from a clean tree on current trusted main, so the credential-shaped historical fixture is absent.

Exact-head validation

Head 0e0be894ed0d060d41d433f9c8feb00a90f65079:

• secret scan run 30982226825 — passed, including full-history scanning;
• Publish organization .github governance directly run 30982226813 — passed, including the focused App-only publisher tests;
• Fiducia secret-delivery contract — passed;
• kustomize overlay rendering — passed;
• two repository-wide jobs remain red only because required private submodules could not initialize (backend pins + private deployment contracts, api docs + static repo contracts). No related check is being waived or rewritten in this PR.

Remaining gates

Keep this PR draft until:

• the repository-wide private-submodule credential gate is restored or independently classified by its owning issue;
• protected App credentials are provisioned through an approved source; and
• one trusted-main execution retains a redacted report proving 61 unique verified <org>/.github repositories.

No 61-organization publication is claimed complete. Linear: DEN-2034