fix(ci): prevent backport update job from failing on every PR

Move the GitHub App token generation step after the backport PR lookup
in the update-backport job. The lookup now uses the default github.token
(which always works) and all subsequent steps are skipped when no
backport PRs exist. This prevents the job from failing on every PR push
due to token generation errors when there's nothing to update.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Saadnajmi

.github/workflows/microsoft-backport.yml

@@ -200,17 +200,10 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - name: Generate GitHub App token
-        uses: actions/create-github-app-token@v2
-        id: app-token
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Find linked backport PRs
         id: find-backports
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
           HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
@@ -234,6 +227,14 @@ jobs:
             echo "$BACKPORT_PRS" > /tmp/backport-prs.txt
           fi
 
+      - name: Generate GitHub App token
+        if: steps.find-backports.outputs.found == 'true'
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Checkout
         if: steps.find-backports.outputs.found == 'true'
         uses: actions/checkout@v4