Add optional GitHub App authentication for Dispatch

[joryirving]

Problem

Dispatch currently authenticates to GitHub with a single GITHUB_TOKEN PAT.

That makes GitHub timeline attribution muddy when the same GitHub account/token family is also used by local OpenCode, Saffron, and other automation. In issue timelines, mutations all appear to come from the same actor, which makes debugging label/status changes painful.

Example problem:

• Dispatch may mutate labels/status.
• Saffron may mutate labels/status.
• Local OpenCode may mutate labels/status.
• GitHub timeline only shows the same account actor.

Desired behavior

Add optional GitHub App authentication for Dispatch so Dispatch can authenticate as its own GitHub App installation.

When configured, GitHub timeline mutations should appear under the Dispatch GitHub App bot identity instead of the shared PAT account.

Proposed env vars

• GITHUB_APP_ID
• GITHUB_APP_INSTALLATION_ID
• GITHUB_APP_PRIVATE_KEY

Private key should support:

• normal PEM with real newlines
• escaped \n form from Kubernetes/ExternalSecrets-style env injection

Expected behavior

• If all GitHub App env vars are present, Dispatch uses GitHub App installation auth.
• If GitHub App env vars are absent, Dispatch falls back to existing GITHUB_TOKEN behavior.
• Partial GitHub App config should fail clearly or fall back safely, but must not produce confusing auth behavior.
• Installation token should be cached until shortly before expiry.
• Secrets/tokens/private keys must never be logged.

Implementation notes

Current GitHub helper code uses process.env.GITHUB_TOKEN directly in src/lib/github.ts.

Prefer centralizing auth behind a helper such as:

• getGitHubToken()
• getHeaders()

so the rest of the GitHub client code remains unchanged.

Acceptance criteria

• Existing PAT-based auth still works with only GITHUB_TOKEN.
• GitHub App auth works when app env vars are configured.
• Installation token is cached and refreshed before expiry.
• Escaped-newline private key format is supported.
• README and .env.example document the optional GitHub App env vars.
• Tests cover PAT fallback and GitHub App selection.
• No secrets are logged.
• npm run lint
• npm run typecheck
• npm run test
• npm run build

Notes

Do not rotate or commit real credentials.

Do not touch home-ops in this issue.

This is a Dispatch app feature, not a worker-script change.