Read Github App Installation Token

A freshly minted (or cached, still-live) GitHub App installation token -- FOR SERVICES ONLY, and only services that speak to GitHub on this build's behalf: the rooster production service (pushing fix branches, opening/merging pull requests, filing issues -- apps/ rooster/entrypoint.sh, apps/api/tools/rooster_worker/drain.py) and roost-ci's ci-service (posting the railway-ci/verdict commit status, a separate Railway project with no direct database access of its own). Both replace a copy of the same exposed personal access token (issue #2488) with a token that is worthless again within the hour.

Gated on system:github_app:mint_token, not system:credentials:read -- see that dependency's own comment for why a second, narrower key. 404 when the slot is not configured yet (neither credential pasted), 502 when GitHub itself refused the mint -- both are the caller's cue to fall back to its own static token, logging loudly that it did.

ISS-1996: a mint waits on GitHub for up to ten seconds, and callers behind the mint lock wait on that one, so the route holds no pool connection: each read takes a slot and gives it back before the call goes out.