Stop using GitHub PATs inside this repo

[premun]

Instead, we're using a new app Maestro CI with a private key stored in a KeyVault from which we can get the tokens signed

#4799

[Copilot]

Pull request overview

This PR migrates Arcade Services CI authentication away from long-lived GitHub PATs and toward short-lived GitHub App installation tokens minted at runtime by signing a JWT with a private key stored as an Azure Key Vault key (sign operation).

Changes:

• Add environment variables (keyVaultName, ciGitHubAppClientId) for prod/int pipelines to support GitHub App token minting.
• Introduce a reusable pipeline step template plus a PowerShell helper to mint GitHub App installation tokens via Key Vault signing.
• Switch release creation and E2E scenario tests to use the minted installation token instead of PAT-backed variables.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
eng/pipelines/templates/variables/prod.yml	Adds prod Key Vault + GitHub App client ID variables used for token minting.
eng/pipelines/templates/variables/int.yml	Adds int Key Vault + GitHub App client ID variables used for token minting.
eng/pipelines/templates/steps/get-github-app-installation-token.yml	New reusable step for minting an installation token via AzureCLI + PowerShell.
eng/pipelines/templates/stages/deploy.yaml	Uses the new token-minting step and switches GH_TOKEN to the GitHub App token.
eng/pipelines/templates/jobs/e2e-pcs-tests.yml	Mints a GitHub App token for scenario tests and wires it into GITHUB_TOKEN.
eng/Get-GitHubAppToken.ps1	New script that signs a JWT with Key Vault and exchanges it for an installation token.
.vault-config/product-construction-prod.yaml	Removed (previous PAT/GitHub secret configuration).
.vault-config/product-construction-int.yaml	Removed (previous PAT/GitHub secret configuration).
.vault-config/product-construction-dev.yaml	Removed (previous PAT/GitHub secret configuration).