ci: sign docs-sync commits with a GitHub App token

[tbjers]

Why

The export-docs.yml workflow opens a docs-sync PR against CoverageTracker/coverage-tracker, which requires signed commits on PRs. Four prior iterations failed for two root causes:

• gitsign (ci: add gitsign to export workflow #6, ci: add chainguard gitsign #8) — Sigstore signatures always show Unverified on GitHub (its roots aren't in GitHub's trusted CA set), so branch protection rejects them regardless of config.
• PAT + sign-commits: true (ci: switch to fine-grained personal access token #9) — peter-evans/create-pull-request builds commits via the GitHub API, which only signs them (as the app bot, Verified) when authenticated with a bot token. A PAT creates the PR but leaves commits unsigned. (ci: switch to GITHUB_TOKEN signing #7's GITHUB_TOKEN also can't write cross-repo.)

What

Authenticate with a GitHub App installation token so sign-commits: true yields GitHub-Verified commits:

• Add actions/create-github-app-token@v2 step, scoped with owner: CoverageTracker + repositories: coverage-tracker (mandatory for the cross-repo target).
• Use the app token in both the coverage-tracker checkout and the create-pull-request step.
• Remove the Setup Gitsign step and the now-unused id-token: write permission.
• Keep sign-commits: true.
• Update README.md provisioning section: PAT → dedicated GitHub App (DOCS_SYNC_APP_ID / DOCS_SYNC_APP_PRIVATE_KEY).

Required manual setup before this works

Create a GitHub App on the CoverageTracker org (Contents RW + Pull requests RW), install it on coverage-tracker, and add secrets DOCS_SYNC_APP_ID + DOCS_SYNC_APP_PRIVATE_KEY to this repo.

Verify

Trigger the workflow, then confirm the docs-sync PR commits carry the green Verified badge and are authored by the app bot — a green run with unverified commits is the current failure mode.

🤖 Generated with Claude Code