fix(ci): use org PAT for terraphim-clients workflow dispatch Refs #2706

CLIENTS_REPO_TOKEN was never configured; fallback GITHUB_TOKEN cannot dispatch
cross-repo (403). Reuse DESKTOP_REPO_TOKEN org PAT, same as desktop release trigger.

Author: Test User

.github/workflows/release-comprehensive.yml

@@ -511,7 +511,9 @@ jobs:
       - name: Dispatch terraphim-clients release-binaries workflow
         uses: actions/github-script@v9
         with:
-          github-token: ${{ secrets.CLIENTS_REPO_TOKEN || secrets.GITHUB_TOKEN }}
+          # Org-level PAT (same secret as desktop dispatch). GITHUB_TOKEN cannot
+          # dispatch workflows in other repos regardless of job permissions.
+          github-token: ${{ secrets.DESKTOP_REPO_TOKEN }}
           script: |
             const version = context.ref.replace('refs/tags/v', '');
             const releaseTag = context.ref.replace('refs/tags/', '');

docs/runbooks/release.md

@@ -119,6 +119,10 @@ Do **not** force-push tags. Fix workflows, bump to next patch (e.g. v1.20.4 →
 | Secret | Repo | Purpose |
 |--------|------|---------|
 | `CARGO_REGISTRIES_TERRAPHIM_TOKEN` | terraphim-clients | Private registry during build |
-| `CLIENTS_REPO_TOKEN` | terraphim-ai | Dispatch clients workflow |
-| `TERRAPHIM_AI_RELEASE_TOKEN` | terraphim-clients | Upload binaries to terraphim-ai release |
-| `OP_SERVICE_ACCOUNT_TOKEN` | terraphim-ai, terraphim-clients | macOS signing via 1Password |
+| `DESKTOP_REPO_TOKEN` | terraphim-ai (org PAT) | Cross-repo workflow dispatch (desktop + clients) |
+| `TERRAPHIM_AI_RELEASE_TOKEN` | terraphim-clients (org PAT) | Upload client binaries to terraphim-ai release |
+| `OP_SERVICE_ACCOUNT_TOKEN` | terraphim-ai, terraphim-clients | macOS signing via 1Password |
+
+`DESKTOP_REPO_TOKEN` and `TERRAPHIM_AI_RELEASE_TOKEN` should be the same org-level
+fine-grained PAT (or classic PAT) with `actions:write` and `contents:write` on
+`terraphim/*` repos. The per-job `GITHUB_TOKEN` cannot replace them for cross-repo calls.