ci: AUT-1408 replace cicd PAT with GitHub App tokens

[svcnemo-autobot]

Background

cicd-main used the long-lived secrets.PAT credential across preflight, builds, tests, statuses, comments, and Megatron-Bridge integration.

What changed

Mint short-lived GitHub App tokens from vars.BOT_ID and secrets.BOT_KEY in every consuming job. Scope the cross-repository token explicitly to NVIDIA-NeMo/Megatron-Bridge.

Details

flowchart LR
  ID[BOT_ID] --> Token[Mint app token]
  Key[BOT_KEY] --> Token
  Token --> Local[Megatron-LM jobs]
  Token --> Bridge[Megatron-Bridge integration]

Loading

The token action is pinned to immutable v3.2.0. Existing local action input names remain unchanged.

Tested

• BASE_REF=main CHECK_ONLY=true SKIP_DOCS=false bash tools/autoformat.sh
• Workflow YAML parsing and per-job token-order assertions
• Verified 10 token steps, 12 downstream consumers, and zero secrets.PAT references
• git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

This PR has been automatically converted to draft because all PRs must start as drafts.

When you are ready for review, click Ready for Review to begin the review process. This will:

1. Add the oncall reviewer (optional reviewer)
2. Add required review teams based on your changes

See the contribution guide for more details.

[svcnvidia-nemo-ci]

/ok to test 1f3b499