GitHub App token scoping for cross-repo CI status checks

When a workflow in repo A needs to call APIs on repo B, secrets.GITHUB_TOKEN won't work (scoped to repo A only). Use actions/create-github-app-token@v3 with owner: <org> to get a token with access to all org repos (app must be installed org-wide). In getsentry/publish, the CI poller uses TWO tokens: sentry-release-bot (installed on all getsentry repos) for cross-repo CI status calls, and sentry-internal-app for label/comment operations on the publish repo itself. Separate tokens because some repos don't have sentry-internal-app installed.