[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

[ennyjfrick]

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived baton-ci app token scoped to the current repo.

Mirrors the OPS-1300 templated workflow pattern. With the Connector Rules ruleset hardened, the legacy PAT only continues to work because of the temp org-admin mitigation; this PR replaces it with the proper App-token bypass actor before that mitigation is removed.

Linear: OPS-1301

🤖 Generated with Claude Code

[linear]

OPS-1301 Replace RELENG_GITHUB_TOKEN in legacy untemplated capabilities workflows

[github-actions]

Claude finished @ennyjfrick's task in 49s —— View job

---

PR Review: [OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

• Gather context and read changed files
• Review PR diff against origin/main
• Post review feedback

---

Summary

This PR replaces the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived baton-ci GitHub App token in the capabilities_and_config.yaml workflow. The change is clean and follows the established pattern.

Review

LGTM — this is a straightforward and well-scoped security improvement.

What changed:

• A new "Mint baton-ci app token" step is added before checkout, using actions/create-github-app-token@v2
• The checkout step switches from ${{ secrets.RELENG_GITHUB_TOKEN }} to ${{ steps.ci-token.outputs.token }}

What I verified:

• The token-minting block is identical to the existing pattern in update-dependencies.yaml (same action version, same inputs, same step id) — consistent and correct.
• The EndBug/add-and-commit@v9 step at the end of the workflow doesn't specify an explicit github_token input, so it inherits the token from the checkout step. Since checkout now uses the app token, pushes will be attributed to the baton-ci app — this is the desired behavior and ensures the commit can bypass the Connector Rules ruleset.
• Token scope is correctly narrowed to owner + current repository only.

Remaining RELENG_GITHUB_TOKEN references (informational, not blocking):

• .github/workflows/release.yaml
• .github/workflows/verify.yaml

These are presumably tracked separately (the PR description mentions this mirrors OPS-1300 for the templated workflow pattern).

No issues found. Ship it.