#31269 ci: isolate nightly smoke reads from routing App

The routing App token in #31254 still requested Actions read permission even after placement moved Actions and status reads to the workflow token. This follow-up removes that unused permission and makes the nightly launch smoke use github.token for its in-flight and snapshot reads, leaving the routing token only for runner and queue placement reads.

This closes the follow-up from #31254 (review receipt: https://github.com/manaflow-ai/cmux/pull/31254#issuecomment-6562982813). It covers the nightly launch-smoke picker; the cmux-tui tree-request path is handled separately in HQ.

Tests:

• python3 -m unittest tests.test_ci_admission_placement tests.test_ci_late_placement tests.test_nightly_next_launch_smoke

agent-identity footer --repo manaflow-ai/cmux
Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Removes the unused Actions read permission from the routing App token and switches the nightly launch smoke to github.token for in-flight and snapshot reads, leaving the routing token for runner and queue placement reads only.

Closes the follow-up from #31254.