ci: replace spear-resumes deploy key with a least-privilege GitHub App

[Jesssullivan]

Current truth

PR #242 remains blocked because the blog needs read-only source access to the private spear-resumes Bzlmod module. The ambient GITHUB_TOKEN is scoped to this repository and cannot perform that cross-repository checkout. Reusing the broader blog-shadow or GF Apps would expand authority beyond the source-read need.

Target contract

Create a dedicated GitHub App installed only on Jesssullivan/spear-resumes with repository Contents: read and no other permission.

Blog-side names:

• variable: SPEAR_RESUMES_READ_APP_CLIENT_ID
• secret: SPEAR_RESUMES_READ_APP_PRIVATE_KEY

Implementation

• Mint a one-hour token with actions/create-github-app-token@v3 in both ci.yml and build-cv.yml.
• Scope the action again to owner Jesssullivan, repository spear-resumes, and permission-contents: read.
• Checkout exact commit d5112bf1fd15fbf28eb684b12c74af6f3a664d14 under .ci-inputs/spear-resumes with persist-credentials: false.
• Add .ci-inputs to .bazelignore.
• Extend scripts/bazel-cache-backed.sh to validate an absolute SPEAR_RESUMES_MODULE_PATH containing MODULE.bazel and pass --override_module=spear_resumes=<absolute-path>.
• Use --override_module, not --override_repository; this dependency is a Bzlmod module.
• Revoke the minted token in post-job cleanup.

Acceptance

• Missing, relative, and invalid module paths fail closed.
• A valid path forwards the exact --override_module flag.
• Both affected workflows pass on exact head.
• PR chore(tinyvectors): retire the npm lane — registry tag archive at v0.3.5 #242 merges only after the private source checkout and Bazel build are green.
• Remove SPEAR_RESUMES_DEPLOY_KEY only after the replacement is proved on main.

Non-goals

No PAT, no reuse of broader Apps, no GF credential, no source-ref drift, and no secret deletion before green replacement proof.