chore(gocd): use GitHub App credentials

[joshuarli]

Replace GoCD GitHub token references with GitHub App credentials.

• Pass GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY to GoCD jobs.
• Preserve legacy runtime compatibility where the existing helper supports it.

[sentry]

Bug: The workflow change allows pull requests to trigger a job that may overwrite the production :latest Docker image, as there is no condition to prevent this.
_{Severity: CRITICAL}

Suggested Fix

Add a condition to the image push steps to ensure they only execute on pushes to the default branch, not on pull request events. For example, change the step's condition to if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch. This will prevent PRs from overwriting the production image.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/image.yml#L12

Potential issue: The workflow condition was changed to `if: github.event_name ==
'pull_request' || github.ref_name == github.event.repository.default_branch`, allowing
the `build-production` job to run on pull requests. This job pushes to production Google
Artifact Registries and uses `tag_latest: true`. Because there is no explicit condition
to prevent pushes on pull request events, a build triggered by a PR could overwrite the
production `:latest` Docker image. This could result in an unvetted or unstable version
of the application being deployed to production.