fix: avoid secrets in reusable workflow conditions

[seekskyworld]

Summary

• avoid referencing secrets directly in reusable workflow if expressions
• detect GitHub App auth configuration in a shell step before creating the App token

Testing

• YAML parse
• git diff --check