fix(ci): authenticate the cloud tag dispatch with a GitHub App token

This workflow has failed on every run since 2026-06-16 -- 19 consecutive
failures with curl exit 22 (401) -- because CLOUD_REPO_DISPATCH_TOKEN, a static
PAT, expired. Nothing alerted, so every ComfyUI version bump in Comfy-Org/cloud
since mid-June has been opened by a human noticing rather than by automation.

Mint a per-run GitHub App token instead, scoped to Comfy-Org/cloud, matching how
cloud's own bump-comfyui-on-tag.yml already authenticates. App tokens cannot
silently expire.

Also open a tracking issue on failure, so the next breakage surfaces instead of
sitting unnoticed for two months.

.github/workflows/tag-dispatch-cloud.yml

@@ -9,9 +9,21 @@ jobs:
   dispatch-cloud:
     runs-on: ubuntu-latest
     steps:
+      # A GitHub App token is minted per run and cannot silently expire the way a
+      # static PAT does. Comfy-Org/cloud's own bump-comfyui-on-tag.yml already
+      # authenticates this way; this brings the sending half in line with it.
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.CLOUD_DISPATCH_APP_ID }}
+          private-key: ${{ secrets.CLOUD_DISPATCH_APP_PRIVATE_KEY }}
+          owner: Comfy-Org
+          repositories: cloud
+
       - name: Send repository dispatch to cloud
         env:
-          DISPATCH_TOKEN: ${{ secrets.CLOUD_REPO_DISPATCH_TOKEN }}
+          DISPATCH_TOKEN: ${{ steps.app-token.outputs.token }}
           RELEASE_TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -43,3 +55,20 @@ jobs:
             -d "$PAYLOAD"
 
           echo "✅ Dispatched ComfyUI tag ${RELEASE_TAG} to Comfy-Org/cloud"
+
+      # This workflow failed silently on every run for two months. A failure here
+      # means the cloud bump PR is not opened and someone has to notice by hand, so
+      # make it visible rather than relying on anyone watching the Actions tab.
+      - name: Open an issue if the dispatch failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh issue create \
+            --title "Cloud tag dispatch failed for ${RELEASE_TAG}" \
+            --body "The dispatch to Comfy-Org/cloud failed for \`${RELEASE_TAG}\`, so the cloud ComfyUI bump PR was not opened automatically and must be triggered by hand (run the 'Bump ComfyUI on Upstream Tag' workflow in Comfy-Org/cloud).
+
+          Run: ${RUN_URL}" \
+            --label "bug" || echo "::warning::Could not open tracking issue"