docs: bound GitHub App lifecycle safety guidance

[Nickfost]

Summary

• make token-producing verification discard stdout
• separate reviewed-checkout pre-install verification from installed-manager verification
• replace executable rotation and retirement prose with bounded safety gates
• require verified encrypted PEM transfer before workstation deletion
• defer custom paths, symlinks, and secret-manager lifecycles to feat: Add Bash bootstrap-github.sh to automate GitHub App and runner-group provisioning #27

Safety boundary

This documents only the normal host-local, root-owned PEM workflow. It adds no credential lifecycle implementation and performs no credential or infrastructure operation.

Validation

• documentation contract
• Markdown lint and links
• shellcheck
• git diff --check
• committed-secret scan
• repository tests available without Docker
• full GitHub Actions suite requested (Docker is unavailable in the local session)

Supersedes #64.

[Nickfost]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4d37aae43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4d37aae43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Nickfost]

@codex review

Please review exact head: d8fdf866f97284f1635e3e1abfafd46b347d276d.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: d8fdf866f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".