fix(opentofu): use GitHub App token for generated docs

[xnoto]

Summary

• use the dedicated OpenTofu docs OIDC role only when same-repository PR docs generation changes README.md
• retrieve the existing GitHub App key from AWS Secrets Manager under a masked environment-variable alias
• mint a current-repository GitHub App token limited to Contents and Pull requests permissions, then use it for the generated-docs push
• keep fork PRs uncredentialed

Validation

• reviewed the reusable workflow interface and its current caller
• inspected the workflow diff and action input schemas
• GitHub Actions checks will run on this pull request

[github-actions]

Shared workflows CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed