fix: use GitHub App token for token count workflow

Switches from default GITHUB_TOKEN to a scoped GitHub App token
so the workflow can push to the protected main branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/update-tokens.yml

@@ -5,14 +5,19 @@ on:
     branches: [main]
     paths: ['src/**', 'container/**', 'launchd/**', 'CLAUDE.md']
 
-permissions:
-  contents: write
-
 jobs:
   update-tokens:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - uses: actions/setup-python@v5
         with: