[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml (#147)

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived
baton-ci app token scoped to the current repo. Mirrors the OPS-1300
templated workflow pattern; needed before the temp org-admin
mitigation can safely be removed.

Linear: https://linear.app/ductone/issue/OPS-1301

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ennyjfrick

.github/workflows/capabilities_and_config.yaml

@@ -11,10 +11,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Mint baton-ci app token
+        id: ci-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.BATON_CI_CLIENT_ID }}
+          private-key: ${{ secrets.BATON_CI_SECRET_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.RELENG_GITHUB_TOKEN }}
+          token: ${{ steps.ci-token.outputs.token }}
 
       - name: Setup Go
         uses: actions/setup-go@v5