An App private key is not scoped: it can mint tokens for every repo its
App is installed on, with the App's full entitlement. The owner and
repositories inputs are step arguments, not a boundary.
cloud-code-bot is entitled to cloud's production release and migration
workflows, so storing its key in this public repo would join the two
repos' trust boundaries at the weaker one. Use a single-purpose App
holding only contents:write on Comfy-Org/cloud instead -- the same
minimal scope the outgoing PAT had, without the silent expiry.