Fix versioning job: replace expired PAT with GitHub App token

The POLICYENGINE_GITHUB PAT is expired/revoked, causing the versioning
job to fail with "could not read Username" on checkout. Replace with
actions/create-github-app-token, matching the pattern used in
policyengine-us and policyengine-api-v2-alpha.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: anth-volk

.github/workflows/push.yml

@@ -54,10 +54,16 @@ jobs:
       && !(github.event.head_commit.message == 'Update PolicyEngine API')
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Checkout repo
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.POLICYENGINE_GITHUB }}
+          token: ${{ steps.app-token.outputs.token }}
       - name: Setup Python
         uses: actions/setup-python@v5
         with:

changelog.d/fix-versioning-auth.fixed.md

@@ -0,0 +1 @@
+Fix versioning job authentication by replacing expired PAT with GitHub App token.