fix(ci): unify cross-repo dispatch on TERRAPHIM_ORG_GITHUB_TOKEN

Prefer org PAT secret with legacy fallbacks for desktop and clients
workflow dispatch. Document secret aliases in release runbook.

Author: Test User

.github/workflows/release-comprehensive.yml

@@ -484,7 +484,7 @@ jobs:
         uses: actions/github-script@v9
         continue-on-error: true
         with:
-          github-token: ${{ secrets.DESKTOP_REPO_TOKEN }}
+          github-token: ${{ secrets.TERRAPHIM_ORG_GITHUB_TOKEN || secrets.DESKTOP_REPO_TOKEN }}
           script: |
             const tag = context.ref.replace('refs/tags/', '');
             console.log(`Triggering desktop release for tag: ${tag}`);
@@ -511,9 +511,9 @@ jobs:
       - name: Dispatch terraphim-clients release-binaries workflow
         uses: actions/github-script@v9
         with:
-          # Org-level PAT (same secret as desktop dispatch). GITHUB_TOKEN cannot
+          # Org-level PAT for cross-repo workflow dispatch. GITHUB_TOKEN cannot
           # dispatch workflows in other repos regardless of job permissions.
-          github-token: ${{ secrets.DESKTOP_REPO_TOKEN }}
+          github-token: ${{ secrets.TERRAPHIM_ORG_GITHUB_TOKEN || secrets.DESKTOP_REPO_TOKEN || secrets.CLIENTS_REPO_TOKEN }}
           script: |
             const version = context.ref.replace('refs/tags/v', '');
             const releaseTag = context.ref.replace('refs/tags/', '');

docs/runbooks/release.md

@@ -119,10 +119,13 @@ Do **not** force-push tags. Fix workflows, bump to next patch (e.g. v1.20.4 →
 | Secret | Repo | Purpose |
 |--------|------|---------|
 | `CARGO_REGISTRIES_TERRAPHIM_TOKEN` | terraphim-clients | Private registry during build |
-| `DESKTOP_REPO_TOKEN` | terraphim-ai (org PAT) | Cross-repo workflow dispatch (desktop + clients) |
+| `TERRAPHIM_ORG_GITHUB_TOKEN` | terraphim-ai (org PAT) | Cross-repo workflow dispatch (desktop + clients) |
+| `DESKTOP_REPO_TOKEN` | terraphim-ai | Legacy alias — same value as `TERRAPHIM_ORG_GITHUB_TOKEN` |
+| `CLIENTS_REPO_TOKEN` | terraphim-ai | Legacy alias — same value as `TERRAPHIM_ORG_GITHUB_TOKEN` |
 | `TERRAPHIM_AI_RELEASE_TOKEN` | terraphim-clients (org PAT) | Upload client binaries to terraphim-ai release |
 | `OP_SERVICE_ACCOUNT_TOKEN` | terraphim-ai, terraphim-clients | macOS signing via 1Password |
 
-`DESKTOP_REPO_TOKEN` and `TERRAPHIM_AI_RELEASE_TOKEN` should be the same org-level
-fine-grained PAT (or classic PAT) with `actions:write` and `contents:write` on
-`terraphim/*` repos. The per-job `GITHUB_TOKEN` cannot replace them for cross-repo calls.
+`TERRAPHIM_ORG_GITHUB_TOKEN`, `DESKTOP_REPO_TOKEN`, `CLIENTS_REPO_TOKEN`, and
+`TERRAPHIM_AI_RELEASE_TOKEN` should share one org-level fine-grained PAT (or classic
+PAT) with `actions:write` and `contents:write` on `terraphim/*` repos. The per-job
+`GITHUB_TOKEN` cannot replace them for cross-repo calls.