Use GitHub app auth

[morganchen12]

TODOs to complete this setup:

• Add secrets to Secret Manager
• Set up service account that can read secrets from Secret Manager
• Maybe auth the git clone using the IAT so if it fails, it fails early instead of creating the commit and failing to push

Tested this on my personal project (just fetching the token) and it succeeded.

[gemini-code-assist]

Code Review

This pull request updates the scripts/publish/cloudbuild.yaml workflow to dynamically request a GitHub App Installation Access Token (IAT) using a JWT signed with the App's private key, replacing the previous static credentials setup. The review feedback highlights several critical security and reliability improvements: removing a log statement that exposes the generated JWT, securely cleaning up the temporary private key file using a shell trap, correcting the GitHub API version header, utilizing Node.js instead of a fragile sed regex to parse the token response, and ensuring the token is written to /workspace/hub so subsequent build steps can access it.