ci: scope the role-permissions token to saas-proto (#5021)

The Update Custom Role Permissions workflow has failed on every run since
it was added in #4293 (6 of 6 scheduled runs, starting 2026-06-29). It
fetches protogen/custom_role_permissions.json from the private saas-proto
repo, and every run failed with:

    Error: HTTP 404: {"message":"Not Found", ...}

The 404 is misleading. The file exists at that path. The problem is that
create-github-app-token scopes the token to the current repository when
neither owner nor repositories is set, so the token cannot see saas-proto,
and GitHub returns 404 rather than 403 for private repos a token cannot
see.

Set owner and repositories so the token covers both repos. This matches
what temporalio/cli does in trigger-docs.yml when it dispatches into this
repo.

Requires the temporal-cicd app to be installed on saas-proto with
Contents: read. If it is not, token generation now fails with an explicit
"app not installed" error instead of a phantom 404.

Author: lennessyy

.github/workflows/update-custom-role-permissions.yml

@@ -20,6 +20,15 @@ jobs:
         with:
           app-id: ${{ secrets.TEMPORAL_CICD_APP_ID }}
           private-key: ${{ secrets.TEMPORAL_CICD_PRIVATE_KEY }}
+          # Without owner/repositories the token is scoped to this repo only, so
+          # reading custom_role_permissions.json from the private saas-proto repo
+          # returns 404 (GitHub hides private repos a token cannot see rather
+          # than returning 403). documentation must stay in the list because the
+          # later steps push a branch and open the PR with this same token.
+          owner: temporalio
+          repositories: |
+            documentation
+            saas-proto
 
       - name: Checkout docs repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1