fix: use GitHub App token for pinata PR updates

[derekmisler]

Problem

The update-pinata job was failing because it used RELEASE_TOKEN (a PAT with only repo and workflow scopes). The gh pr edit --add-reviewer call requires read:org scope to resolve reviewer usernames, which this PAT lacks.

Solution

Replace RELEASE_TOKEN with a GitHub App token from the docker-agent[bot] app, following the same pattern already used in review-pr.yml. The app is already installed on docker/pinata with the necessary permissions: contents write, pull requests write, and members read (which satisfies the reviewer lookup).

Changes (update-pinata job only)

1. Added a new first step — Generate GitHub App token — using tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a (v2, same SHA pin as review-pr.yml). The token is scoped to the pinata repository specifically via repositories: ["pinata"].

2. Checkout pinata: token changed from secrets.RELEASE_TOKEN → steps.app-token.outputs.token

3. Create or update PR: GH_TOKEN changed from secrets.RELEASE_TOKEN → steps.app-token.outputs.token

4. Git identity: Updated user.name / user.email to docker-agent[bot] so commits and PR actions in pinata appear under the correct bot identity.

Not changed

The release job still uses RELEASE_TOKEN — it needs that PAT for pushing tags and creating releases on cagent-action itself, which the app token is not scoped to.