Use the existing controller PAT for branch tracking

docs/upstream-sources.md

@@ -89,21 +89,20 @@ only `omarchy-dev` also updates `omarchy-settings-dev`.
 ### Enable unattended branch updates
 
 The schedule already runs in GitHub Actions; no server cron job is needed.
-It needs a GitHub App identity so its PRs trigger builds and its merges trigger
-publishing without manual approval:
+It uses a personal access token so its PRs trigger builds and its merges trigger
+publishing without manual approval. No GitHub App is required.
 
-1. [Create an organization GitHub App](https://github.com/organizations/omacom/settings/apps/new).
-   Use this repository's URL as the homepage, disable webhooks, and grant only
-   repository **Contents: Read and write** and **Pull requests: Read and write**
-   (Metadata read access is automatic). Limit installation to this organization.
-2. Install the App on **omacom/omarchy-pkgs** only.
-3. Generate a private key from the App's settings. In the repository's
+1. Use a fine-grained PAT with access to **omacom/omarchy-pkgs** and repository
+   **Contents: Read and write** and **Pull requests: Read and write** permissions.
+   Its owner must be trusted by the build workflow (for example, a collaborator).
+   The existing controller PAT can be reused when it has these permissions.
+2. In the repository's
    [Actions secrets](https://github.com/omacom/omarchy-pkgs/settings/secrets/actions),
-   save the App ID as `PKGS_BOT_APP_ID` and the PEM key contents as
-   `PKGS_BOT_PRIVATE_KEY`.
-4. Keep **Allow auto-merge** enabled and require `result`, `self-tests`, and
-   `build-isolation` on `master`; the App does not need a protection bypass.
-5. After merging the tracker, run **Track upstream branches** once from Actions
+   save the PAT as `PKGS_BOT_TOKEN`. Update this secret when the token is rotated
+   or expires. The built-in Actions `GITHUB_TOKEN` cannot run this unattended chain.
+3. Keep **Allow auto-merge** enabled and require `result`, `self-tests`, and
+   `build-isolation` on `master`; the tracker does not request a protection bypass.
+4. After merging the tracker, run **Track upstream branches** once from Actions
    to verify that its PR builds, auto-merges, and starts **Publish merged packages**.
    Subsequent runs happen every two hours.