ci: use dedicated PAT for cross-repo workflow dispatch

[lwshang]

Summary

• The promote-network-launcher workflow added in ci: add network-launcher bump and promote workflows #561 failed on its first run with HTTP 403 from gh workflow run — PR_AUTOMATION_BOT_PUBLIC does not have actions: write on dfinity/icp-cli-network-launcher (its scope is PR creation, not workflow dispatch).
• Replace the GitHub App token with a fine-grained PAT (NETWORK_LAUNCHER_DISPATCH_PAT) scoped only to Actions: Read and write on dfinity/icp-cli-network-launcher.
• Inline-document the rotation steps so the next rotation (max 1y expiry) doesn't require digging through git history.

Notes

• The PAT is pending org-level approval from IDX (standard for fine-grained PATs in the dfinity org).
• A separate PAT will be created for the reverse direction (icp-cli-network-launcher → icp-cli) and stored in that repo — see icp-cli-network-launcher#60.

Test plan

• PAT approved by IDX and added as NETWORK_LAUNCHER_DISPATCH_PAT secret on dfinity/icp-cli
• After merge, trigger the workflow (re-write network-launcher-version or re-run the failed run) and confirm the dispatch into icp-cli-network-launcher succeeds

🤖 Generated with Claude Code