[Jammy2211]

Summary

Adds a read-only release gate input that proves the org-owned pyautolabs-bot GitHub App can push to the five release libraries (PyAutoNerves, PyAutoFit, PyAutoArray, PyAutoGalaxy, PyAutoLens). This is the identity the PyAutoHands release path moves to in token phase 1 (PyAutoLabs/PyAutoHands#321).

• New .github/workflows/token_push_check.yml, triggered daily at 04:30 UTC, by workflow_dispatch, and on PRs that touch the check. It mints an App token scoped to the five libraries (contents write) and runs gh auth setup-git. For each library it then runs git ls-remote and git push --dry-run … HEAD:refs/heads/token-push-check-dryrun. The dry run sends no pack and creates no ref.
• New heart/checks/token_push.py runs the probe and writes the sidecar state/token_push.json. On schedule and dispatch the sidecar is committed with [skip ci]. PR runs only upload it as an artifact. Any refused push fails the job.
• state.aggregate folds the committed sidecar into the snapshot as token_push. readiness grades it: a refused push is RED, and a missing, partial or >48 h old sidecar is STALE. The dashboard gets remedies for the STALE keys.

Heart YELLOW acknowledged by the human 2026-10-23 (manifest drift; PyAutoLens release validation stale).

Refs PyAutoLabs/PyAutoHands#321. This PR closes nothing; the issue closes after both PRs merge.

API Changes

None. This adds a new check module and a new readiness reason. There is no change to any public interface.
See full details below.

Test Plan

• python -m pytest tests -q -x → 1305 passed
• Workflow parses as YAML. actionlint 1.7.12 reports only false positives: its bundled metadata for create-github-app-token@v3 predates client-id.
• Local plumbing run of the probe, using a human credential rather than the App: push=True on all five libraries, and no token-push-check-dryrun branch was created.
• The Token Push Check run on this PR shows push=True for all five libraries using the real App token.

Full API Changes (for automation & release notes)

Removed

• None

Added

• heart.checks.token_push (probe, build, load, main): the App push-credential probe and sidecar reader.
• Readiness reasons token_push_refused (red), token_push_unknown (stale) and token_push_stale (stale).

Migration

• None. Until the check first runs on main, readiness shows the STALE reason "release push credential check not run".

Generated by the PyAutoLabs agent workflow.

🤖 Generated with Claude Code