Support external workflow consumers without LibreCode GitHub App credentials

[vitormattos]

Goal

Make the materialized workflow synchronization model genuinely reusable by repositories outside LibreCodeCoop and LibreSign.

Current state

workflow-templates/sync-workflow-templates.yml currently requires:

• vars.LIBRECODE_WORKFLOW_APP_ID;
• secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY;
• the LibreCode GitHub App to be installed for the consumer owner/repository.

That is appropriate for LibreCode-managed repositories, but it makes the published workflow template non-portable for an independent project that only wants to consume the public catalog.

The source catalog itself is public and actions/sync-workflows is reusable; authentication for opening the consumer PR is the remaining organization-specific coupling.

Requirements

Define a portable authentication contract for the consumer updater.

At minimum:

• LibreCode-managed repositories may keep using the LibreCode GitHub App;
• external consumers must be able to use the same workflow without possessing LibreCode secrets;
• support a consumer-owned GitHub App and/or another explicit repository-scoped credential;
• document the behavior and limitation of GITHUB_TOKEN if offered as a fallback, especially whether the resulting PR triggers the consumer's normal CI;
• keep permissions minimal: contents/workflows/pull-requests only where required;
• do not centralize third-party consumer credentials in LibreCode;
• retain immutable SHA pinning for actions/sync-workflows.

Interface

Prefer explicit inputs/configuration over organization-name detection. The workflow should not infer that a consumer belongs to LibreCodeCoop or LibreSign.

The install/update path should remain:

LibreCodeCoop/.github catalog
        ↓
consumer sync workflow
        ↓
actions/sync-workflows
        ↓
consumer-local patches
        ↓
reviewable PR in the consumer repository

Acceptance criteria

• a public repository outside LibreCodeCoop and LibreSign can install the updater using credentials it controls;
• LibreCode repositories retain the GitHub App path;
• no LibreCode private key is required by external adopters;
• normal consumer CI behavior after the generated PR is documented and tested;
• tests cover at least the LibreCode GitHub App path and one organization-independent path.