[SYNC: FVH → laurigates] auto-merge-image-updater: App token + fetch-depth-1 working-directory fix

[laurigates]

Backport: auto-merge-image-updater — App token + fetch-depth-1 working-directory bugfix

Source: ForumViriumHelsinki/.github → reusable-auto-merge-image-updater.yml

Why

• App-token approval identity (needed when branch protection requires an approval from a non-author).
• Genuine bugfix: run gh pr merge --auto --delete-branch from ${{ runner.temp }} so gh skips the local-clone checkout that fails (git checkout -B main origin/main) in a fetch-depth=1 checkout holding only the PR branch.

Sanitization log

None required.

Verification

continue-on-error on approve + fallback token chain preserved. Confidence: high.

---

Part of a feature-parity backport sweep between ForumViriumHelsinki/.github and laurigates/.github. Sanitization verified before any PR is opened; logic is org-agnostic.