Reviewer bees approve under their own bot identity (t27-bees GitHub App) #5547

Owner decision 2026-10-02: reviewer bees must approve pull requests under their OWN identity, not the owner's account gHashTag.

GitHub refuses self-approval, so today a bee using the owner's token can only leave a COMMENTED review on a PR the owner's account opened (measured on #5526: gHashTag COMMENTED). auto-merge-ready-prs.yml needs an APPROVED review plus a bee-reviewed label applied after the last push, so it can never fire for bee pull requests.

Mechanism: a GitHub App t27-bees (acts as t27-bees[bot]; its reviews are real approvals).

Deliverables:

• tools/bees/: app manifest + a local one-command creation flow (manifest flow, POST /app-manifests/{code}/conversions) the owner runs; no secret ever enters the repo.
• tools/bees/bee-token: mints a short-lived installation token from app id + private-key path (env or macOS Keychain); self-test with a throwaway key.
• auto-merge-ready-prs.yml: the APPROVED review that counts must come from vars.BEE_REVIEWER_LOGIN (default t27-bees[bot]), on the head SHA, after the head arrived. Absent app or variable -> fail closed.
• Runbook with the owner's exact steps.