#31284 ci: keep owner waits off shared token quota

The launch-smoke pick job now grants actions: read, so its github.token snapshot download can read Actions state instead of failing open. The cmux-tui owner wait keeps its bounded run and hand-off reads on the routing App's separate read budget, with a workflow-token fallback only when the App token cannot be minted. The fallback-plan and daemon-test jobs no longer carry the routing environment after their reads moved to github.token.

This closes the follow-ups from #31269 and #31272 (receipts: https://github.com/manaflow-ai/cmux/pull/31269 and https://github.com/manaflow-ai/cmux/pull/31272).

Metric	Before	After	Delta	Harness
launch-smoke pick Actions permission	none	actions: read	granted	workflow source scan
owner-wait status and hand-off reads on shared github.token	2 paths	0 when App token is available	-2	workflow source scan
secretless TUI jobs with ci-routing-agent environment	2	0	-2	workflow source scan

Tests:

• python3 -m unittest tests.test_nightly_next_launch_smoke (41 passed)
• YAML parse of .github/workflows/cmux-tui-artifacts.yml and .github/workflows/nightly-next-launch-smoke.yml
• tests/test_cmux_tui_superseded_push.py wiring checks pass; its existing temporary-git fixture fails while pushing multiple refs (the same fixture failure as the prior head)

agent-identity footer --repo manaflow-ai/cmux
Agent session: agent session
🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Moves the cmux-tui owner-wait's bounded status and hand-off reads off the shared github.token budget and onto the routing App's read budget, with a workflow-token fallback only when the App token cannot be minted. The launch-smoke pick job now grants actions: read, so its github.token snapshot download can read Actions state instead of failing open, and the fallback-plan and daemon-test jobs drop the routing environment they no longer use.

Behavior

• Owner-wait mints a routing App token with actions: read when GLAEDA_ROUTE_APP_ID is set and defaults GH_TOKEN to github.token only when that mint fails.
• The fallback-plan and daemon-test jobs no longer reference ci-routing-agent, and tests assert the pick job's bare actions: read permission alongside the smoke job's contents: read.