#31272 ci: keep cmux-tui reads off routing App

The cmux-tui artifacts and tree-request path was still minting the routing App for Actions status, owner-election, superseded, and artifact reads. Those reads now use the workflow GITHUB_TOKEN; the routing App remains available only for runner placement. This removes the routing installation from the tree-request read path while preserving the existing Actions, contents, pull-requests, and OIDC job permissions.

This closes the cmux-tui tree-request follow-up from #31254 (review receipt: https://github.com/manaflow-ai/cmux/pull/31254#issuecomment-6562982813). The nightly launch-smoke split is in #31269.

Metric	Before	After	Delta	Harness
Routing-App read-token mints in cmux-tui-artifacts.yml	4 jobs	0 jobs	-4	workflow source scan
Actions reads using routing App	4 job paths	0 job paths	-4	workflow source scan

Tests:

• python3 tests/test_cmux_tui_superseded_push.py (workflow checks reached the existing temporary-git fixture failure after the token wiring checks)

agent-identity footer --repo manaflow-ai/cmux
Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Stops cmux-tui reads from minting the routing App for Actions status, owner-election, superseded, and artifact checks; those reads now use the workflow GITHUB_TOKEN. The routing App stays reserved for runner placement, closing the tree-request follow-up from #31254.

• Removes routing App token mints from cmux-tui-artifacts.yml tree-preflight, tree-claim, fallback, and daemon-test re-check paths.
• Updates the wiring test to assert the re-check runs immediately after checkout with no intervening token step.