# cc-watch — Replace SNAPSHOT_PR_TOKEN PAT fallback with Release Bot App token

Closes #1735 (W1a-fix) under M134.

## Why

PR #1698 added `token: ${{ secrets.SNAPSHOT_PR_TOKEN || secrets.GITHUB_TOKEN }}` as a half-measure for the snapshot PR. The PAT secret was never created, and the fallback path (`GITHUB_TOKEN`) opens PRs as `github-actions[bot]`, whose pushes do not trigger required CI checks. Auto-merge therefore stalls.

This change mints a Release Bot App installation token using the existing `RELEASE_BOT_APP_ID` + `RELEASE_BOT_PRIVATE_KEY` secrets that `release-please.yml` already uses. App-issued tokens DO trigger CI.

## What changed

    .github/workflows/claude-release-watch.yml | 25 ++++++++++++++-----------
     1 file changed, 14 insertions(+), 11 deletions(-)

- Added `actions/create-github-app-token@1b10c78c…` step (same SHA as `release-please.yml`) just before the `peter-evans/create-pull-request` step.
- Replaced `token: ${{ secrets.SNAPSHOT_PR_TOKEN || secrets.GITHUB_TOKEN }}` with `token: ${{ steps.app_token.outputs.token }}`.
- Dropped the W1a-PAT TODO block referencing `SNAPSHOT_PR_TOKEN`.
- The downstream `gh pr merge --auto` step is unchanged — it correctly continues to use `GITHUB_TOKEN`.

## Validation

- `actionlint .github/workflows/claude-release-watch.yml` — clean.
- `npm run test:manifests` — passed.

## Risk / boundary

Workflow contract preserved: same step `id: cpr`, same outputs, same downstream `gh pr merge` wiring. Only the auth source for `peter-evans/create-pull-request` changed.