Cross-repo write credentials for the central planner (GitHub App) #818

Story

As a org owner,
I want authenticate the central planner as a GitHub App (or org-scoped token) with issues/discussions/contents write across fleet repos,
so that the central planner can create epics, link sub-issues, and post the plan reply in the TARGET repo, which the default GITHUB_TOKEN (scoped only to .github-private) cannot do.

Acceptance Criteria

1. A GitHub App (preferred) or org-scoped PAT is provisioned with issues + discussions + contents (+ pull-requests) write on enrolled fleet repos, and the installation/secret is documented.
2. A token-minting step in the planner's plan job exposes a target-repo-scoped token (e.g. actions/create-github-app-token) that is DISTINCT from GH_PAT_WORKFLOWS (which keeps its workflow_dispatch role).
3. Secret names and least-privilege scopes are documented (docs/initiatives/fleet-credentials.md or an extension of docs/pr-review-agent/machine-user-setup.md).
4. The self path (.github-private planning its own discussions) still works with the new token.

Tasks / Subtasks

• Provision the GitHub App / org secret with least-privilege scopes and install it on the pilot repo + .github-private. (AC: test issue from agent #1)
• Add a token-minting step to initiative-planner.yml's plan job and wire it to the target-repo write calls. (AC: Go-live improvements for PR review agent #2)
• Document the credential model and secret names. (AC: Add @claude delegation, auto-merge, and rebase handling #3)
• Verify the self path still creates epics under the new token. (AC: Optimize review: small-PR and incremental fast paths #4)

Dev Notes

• Mirrors the existing machine-user pattern documented under docs/pr-review-agent/ (bot-setup.md, machine-user-setup.md).
• GITHUB_TOKEN in a workflow is scoped to the workflow's own repo (.github-private); cross-repo issue/discussion writes therefore REQUIRE an App token or org PAT — this is the single hard prerequisite for the fleet path.
• Keep GH_PAT_WORKFLOWS for the workflow_dispatch re-invoke (loop-prevention requires a PAT, not GITHUB_TOKEN — see scripts/initiative-planner/redispatch.sh:17-22); the new token is only for content/issue/discussion writes.
• hands_off: provisioning an App and managing org secrets is an org-admin action, not auto-implementable.

Project Structure Notes

Primarily an infra + docs story; the only code change is the token-minting step in initiative-planner.yml. Sequenced as an independent prerequisite for the live pilot (S8).

References

• docs/pr-review-agent/machine-user-setup.md
• scripts/initiative-planner/redispatch.sh#L17-L22
• .github/workflows/initiative-planner.yml#L97-L117

Likely target surface

• .github/workflows/initiative-planner.yml
• docs/initiatives/fleet-credentials.md (new file)

Story prepared by the BMAD Scrum Master (Bob) for epic #817. Status: ready-for-dev.