TRI CLAW GitHub App runs our own git: golden chain land and push under the App identity, webhook-fed queue #11360

Part of epic #11340 (TRI CLAW for collective work) and #11275. Owner 2026-10-20: build our own git (the golden chain) into the TRI CLAW GitHub App.

Today tri golden land | push | status (specs/tri/land/golden_land.t27 over specs/queen/golden_chain.t27, landing in #11359) runs on one Mac under a personal gh login: the first real link (#11348) went through it. To serve every bee, contributor and repository it must run under the App identity (APP_ID 5166765, specs/claw/github_surface.t27) with narrow tokens.

Boundary

• specs/claw/github_surface.t27
• specs/claw/service.t27
• specs/queen/golden_chain.t27
• specs/tri/land/golden_land.t27

User Scenarios

• Given a bee or a contributor finishes a lane, when it pushes the branch as claude/evolve-* (or any branch TRI CLAW is told to take), then TRI CLAW verifies it locally on the Queen host, lands it on refs/golden/head and opens one batch PR per window under the App, with no personal token anywhere.
• Given a PR is opened by anyone in a gHashTag repository, when the App's webhook receives it, then the branch is queued for the golden chain (the S_NEEDS_HOOK rows become LIVE through the existing t27-bees webhook receiver).
• Given tri golden status or the TRI CLAW MCP tool golden_status, when called, then it shows head, queue, unpushed links and next push for the App's queue.

Requirements

• FR-001: new surface rows in github_surface.t27: golden refs write (contents: write limited to refs/golden/* and claude/golden-* branches), batch PR (pull_requests: write); tests pin that no other permission is minted for the golden job.
• FR-002: the runner is the Queen host or a bench agent, not GitHub Actions (the Actions queue is the jam being removed); service.t27 records the mode.
• FR-003: every rule stays in .t27; the host is argument-vector glue as in cmd_golden.
• FR-004: the App's private key never leaves its store; a token is minted per job with exactly the row's scope.

Success Criteria

• one batch PR authored by tri-claw[bot] from the golden chain merges; t27c test green on the touched specs; no personal token used in the run (shown in the run's evidence).