ci: move every workflow off the App private key

[Verdenroz]

What changed

After this, no workflow in the repo mints an App token. spec.yml and the docs-regen job in ci.yml land through action/bot-token.sh and action/land.sh the same way changelog.yml does. deploy-docs and the release step use github.token. soothfast-gate.yml drops the App entirely and becomes something another repo can call.

• Rewrote the generate job in spec.yml and docs-regen in ci.yml: environment: soothfast-bot, permissions contents: read and id-token: write, checkout with persist-credentials: false, a concurrency group each, and the token minted after the generation step. docs-regen keeps its llms.txt churn filter.
• Switched deploy-docs (peaceiris/actions-gh-pages) and the gh release create step in release.yml to github.token. Attribution-only change: the gh-pages push and the release show github-actions instead of soothfast-bot.
• Made soothfast-gate.yml callable cross-repo. The PR comment uses github.token under pull-requests: write, the PR number reaches the shell through env, CHANGELOG_APP_PRIVATE_KEY stays declared but optional and unused for one release so existing callers keep validating, and a new cli-artifact input selects a prebuilt CLI from the run or falls back to the setup action.
• Pointed the gate matrix in ci.yml at cli-artifact: cargo-soothfast-bin and stopped passing the secret.
• Rewrote the CI section of CLAUDE.md around the broker and added a reusable-gate example to the README's "In CI" section.

Part of #158 and #14.

Why

The App private key was minted in six places. Once the changelog proves the broker path, keeping the other five on the key means two credential paths to reason about and a secret that still has to exist. Moving them together lets the CHANGELOG_APP_* variable and secret be deleted after this merges. The release and gh-pages pushes never needed a bot identity, only write permission, which github.token already grants. A tag push is not a default-branch ref, so the broker would refuse it by design, and that rule stays as is.

How was this tested

• zizmor 1.29.0 across every workflow in .github/workflows/: no findings.
• No App references remain in the workflows outside the unused secret declaration in soothfast-gate.yml.
• Not run end to end: the spec and docs bot PRs fire on the first merge to master after this lands. The gate matrix runs on this PR itself with cli-artifact set, which exercises the artifact path; the setup-action fallback is exercised by the first cross-repo caller.
• make check and make gate were not run for this layer. It changes no Rust.

After merge, by hand: delete the CHANGELOG_APP_CLIENT_ID variable and CHANGELOG_APP_PRIVATE_KEY secret from this repo. That can happen right away; finance-query holds its own copy of the secret and the reusable workflow now ignores it. The first master push after this lands runs spec generate and docs-regen through the broker, so it needs the same prerequisites as #161: broker deployed, soothfast-bot environment created, smoke run green. Watch that push's deploy-docs too: it now pushes gh-pages with github.token, and if the Pages build does not fire the fallback is the official upload-pages-artifact + deploy-pages pair in a separate PR.

Checklist

• make check passes (fmt, clippy -D warnings, cargo test --workspace)
• make gate BASE=master passes, or any intentional cost change is explained above
• Tests added/updated for new behavior (not required for docs/CI-only changes)
• Public API items have /// doc comments
• No new dependency, or its justification is included above (see Dependency Policy)
• Docs (README.md, docs/, soothfast:bind/soothfast:claim markers) updated if behavior changed

[github-actions]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.06% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_sdk::bench_emit_typescript walltime_median_ns 2153622.0 -> 2153622.0 (+0.0%)
ok    soothfast_sdk::bench_emit_typescript allocs 42930 -> 42930 (allowed <= 45076)
ok    soothfast_sdk::bench_emit_typescript alloc_bytes 2938940 -> 2938940 (allowed <= 3085887)
ok    soothfast_sdk::bench_lower walltime_median_ns 1422783.0 -> 1422783.0 (+0.0%)
ok    soothfast_sdk::bench_lower allocs 23907 -> 23907 (allowed <= 25102)
ok    soothfast_sdk::bench_lower alloc_bytes 2064788 -> 2064788 (allowed <= 2168027)
ok    soothfast_sdk::bench_emit_typescript assert complexity: claimed O(n); growth drift x0.99 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_sdk::bench_lower assert complexity: claimed O(n); growth drift x1.33 over sizes [16, 64, 256] (limit x2.5)
gate: passed (2 item(s))

[github-actions]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.10% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_sdk::bench_emit_typescript walltime_median_ns 2137181.0 -> 2137181.0 (+0.0%)
ok    soothfast_sdk::bench_emit_typescript allocs 42930 -> 42930 (allowed <= 45076)
ok    soothfast_sdk::bench_emit_typescript alloc_bytes 2938940 -> 2938940 (allowed <= 3085887)
ok    soothfast_sdk::bench_lower walltime_median_ns 1432236.0 -> 1432236.0 (+0.0%)
ok    soothfast_sdk::bench_lower allocs 23907 -> 23907 (allowed <= 25102)
ok    soothfast_sdk::bench_lower alloc_bytes 2064788 -> 2064788 (allowed <= 2168027)
ok    soothfast_sdk::bench_emit_typescript assert complexity: claimed O(n); growth drift x1.01 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_sdk::bench_lower assert complexity: claimed O(n); growth drift x1.34 over sizes [16, 64, 256] (limit x2.5)
gate: passed (2 item(s))