ci: keep owned-pool rescue reads off routing App
The owned-pool rescue sweeper was minting the runner-routing GitHub App as a read fallback whenever the cmux-bot token was unavailable. Its Actions polling therefore consumed the installation quota shared with picker decisions. This keeps all reads on the workflow's existing cmux-bot token, or github.token when that mint is unavailable, while writes retain the existing token and permissions.
Leo asked: “how's ci? we still have bigger wins we can get? what's the state of it all? more things we can skip/do better”. This addresses the routing App quota drain during CI queue failover. The workflow no longer mints GLAEDA_ROUTE_APP_ID; the script documentation and contract test describe the single-token route. This is easy to revert and changes no trust or permission grants.
| Metric | Before | After | Delta | Harness or run |
|---|---|---|---|---|
| Routing-App Actions reads per empty sweeper pass | 8 | 0 | -8 (-100%) | request-accounting harness run41773390210 (2 artifact + 2 repository-side + 4 rerun listings) |
Validation: cmux-ci test -- python3 -m unittest tests.test_ci_owned_pool_rescue (run 41772984820, source 926e64126936535d3ecec7cd4d09af679d6bbb07; 157 tests passed).
🤖 Generated with Codex
Agent session: agent session