## Summary
- Migrated `draft-stale-prs` and `label-rebase-prs` GitHub Actions
workflows from using a personal access token (`PR_RW_GITHUB_TOKEN`) to
generating tokens via the Dyad GitHub App
(`actions/create-github-app-token@v2`)
- Improves security and auditability by using scoped, short-lived GitHub
App tokens with explicit permissions instead of long-lived PATs

## Test plan
- [ ] Verify `draft-stale-prs` workflow runs successfully on its cron
schedule (or trigger manually)
- [ ] Verify `label-rebase-prs` workflow runs successfully when
triggered by push to `main`
- [ ] Confirm the GitHub App has the required permissions: `contents:
read`, `pull-requests: write`, and `issues: write` (for draft-stale-prs)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3004"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Will Chen <willchen90@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>