fix(ci): push the main mirror with the app token

Run 37168377829 job 111336041355 failed the sync with

  ! [remote rejected] main-sync-source/main -> main (refusing to allow a GitHub
    App to create or update workflow `.github/workflows/README.md` without
    `workflows` permission)

main_from_repository.sh force-pushes the source repository's main verbatim, so
the push carries .github/workflows/** whenever the two trees differ. Five paths
differ between fork/main and origin/main there, four of them real workflows:
call-test-deploy.yml, call-test.yml, entry-cancel-superseded.yml and
entry-push-latest.yml. GitHub names only the alphabetically first, so moving the
README out of that directory would have moved the failure to call-test-deploy.yml
rather than removed it.

Raising the job's permissions cannot work either. actionlint rejects the key:
"unknown permission scope 'workflows'", and its list of the sixteen available
scopes has no entry for it, because `workflows` exists only as a GitHub App
installation permission and never as a GITHUB_TOKEN scope.

The push therefore runs as the bot app, the mechanism cron-update.yml,
cron-collection-source.yml and entry-pr-translate.yml already use. checkout
persists that token instead of GITHUB_TOKEN, whose permissions drop to
contents: read since nothing in the job writes with it any more.

This needs Workflows: write on the app installation. Without it the next run
fails on the same line, naming the bot rather than github-actions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/entry-push-latest.yml

@@ -23,12 +23,20 @@ jobs:
     name: 🔄 Sync main
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
+      - name: ⚙️ Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
       - name: ⬇️ Checkout repository
         uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: 🔄 Sync main from source repository
         shell: bash