claw: every App-token job must pass with a note when the token cannot be minted (token_shape.t27): claw-t27f, claw-suggest, claw-refresh, claw-batch #10576

What

#10501 was one job; the shape is in five more. Every TRI CLAW job that mints an App token with actions/create-github-app-token turns red when the installation lacks a permission or the key is not mintable, instead of passing with a note for the owner.

specs/claw/token_shape.t27 (this issue's PR) is the law, per job under jobs::

• R1 no-continue-on-error: the token step carries continue-on-error: true (flow form or block key).
• R2 no-failure-note: the job has a step with if: steps.tok.outcome == 'failure' that writes the fix to the step summary, or uses the token as steps.tok.outputs.token || github.token.

Run over every workflow on master (2026-10-19, origin/master 90f6248), it names:

auto-merge-ready-prs.yml passes: it already falls back to github.token and records who merged.

Plan

1. The law, sealed, 9/9 tests with no vacuous pass; a negative control drops one rule and the matching tests fail.
2. claw-t27f, claw-suggest, claw-refresh brought to the claw-sarif: ask for no token without a changed .t27, degrade to a step-summary note when the App cannot mint one (Closes #10501) #10568 shape (claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) #10585); claw-batch stays red on purpose, marked # token_shape: red (law clause in claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) #10577).
   2b. [x] Found on the way: claw-refresh was red on every push for a different reason, its GraphQL page of 100 PRs outran the timeout (claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) #10585, 25 a page).
   2c. [ ] After claw-sarif: ask for no token without a changed .t27, degrade to a step-summary note when the App cannot mint one (Closes #10501) #10568 merges: drop scripts/git_commands_tasks_1_4.sh and scripts/mcp-wrapper.sh from the MIGRATION_AUDIT.md row (left out of claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) #10585 to avoid a conflict on that line).
3. Wire the law into gate-topology's claw-drift step (gen/c/claw/token_shape.c committed and held by the spec-guards regen diff), so a new App-token job cannot regress.

Prior art

Codacy's coverage gate hangs on a pull request with nothing to measure, and there is no skip setting (facioquo/stock-indicators-dotnet#2344). CodeRabbit skips reviews on missing permissions. We answer with a checked rule rather than a per-job fix.

Related: #10501, #10568, #10393.