#31254 ci: keep routing App off Actions backlog reads

The routing App installation 164690637 (App manaflow-glaeda-route) is reserved for organization runner reads. The admission-placement and late-placement jobs were also sending previous-attempt, run-list, and job-list reads through that token, so every placement pass spent the same REST core budget needed by runner admission.

This change gives those jobs an explicit GITHUB_TOKEN with actions: read and keeps the App token only on GitHub.runners(). If the workflow token is unavailable, the scripts retain the existing route-token fallback and fail open as before. The tests assert that the two clients receive separate tokens and that the workflow grants the required read permission.

This closes the routing-App caller identified in the quota investigation: placement backlog and previous-attempt reads. It does not change App permissions or runner placement decisions.

Performance:

Metric	Before	After	Delta	Harness
App-token clients used by admission/late placement	2 (runner + Actions reads)	1 (runner only)	-1 App client per placement job	tests.test_ci_admission_placement, tests.test_ci_late_placement
Actions run/job reads authenticated by installation 164690637	1 previous-attempt read + 4 run-list reads + up to 30 job reads	0	all moved to workflow GITHUB_TOKEN	same unit tests and code path audit

Validation: python3 -m unittest tests.test_ci_late_placement tests.test_ci_admission_placement (44 passed).

Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}