feat: open the nightly sync pull request as a github app

[jaspermayone]

You spotted the problem: PR #4 was authored by you, because DNS_BOT_TOKEN is your personal access token. GitHub does not let anybody approve their own pull request, so on a two person team that left exactly one possible reviewer for every sync PR. Not workable.

A GitHub App fixes it. It is the only identity that satisfies all three constraints at once:

	triggers checks	not a person	no expiry
GITHUB_TOKEN	no	yes	yes
Personal access token	yes	no	no
GitHub App	yes	yes	yes

What changed

sync-from-cloudflare.yml mints an installation token with actions/create-github-app-token@v3 and uses it for the checkout, the push, and the gh calls. The commit author is set to the App's own bot identity, because the ruleset has require_extra_approval_for_unattributed_changes on and the author has to match whoever pushed.

The "no checks will run on this pull request" warning in the PR body is gone. With an App it cannot happen.

Draft until the App exists

Merging this before the App is created breaks the nightly sync, so it stays a draft. docs/runbook.md step 1b has the full walkthrough. Short version:

1. https://github.com/organizations/WITCodingClub/settings/apps/new
2. Name WITCC DNS Bot, webhook off, repository permissions Contents, Pull requests, Issues all read/write, nothing else.
3. Generate a private key, install the App on WITCodingClub/dns only.
4. gh secret set DNS_BOT_APP_ID and gh secret set DNS_BOT_PRIVATE_KEY --repo WITCodingClub/dns < the.pem
5. Mark this ready, merge it, then delete DNS_BOT_TOKEN.

Note that App creation is browser-only, same as a PAT. I cannot script it.

[github-actions]

octoDNS plan

This pull request changes no DNS records.

---

Planned against main with a read-only Cloudflare token. Only the zone files at the repository root are included. Changes to config/, bin/ or .github/ are not in this plan, so review those by hand.