`buildActivationAppTokenMintStep` ignores `repositories: ["*"]` sentinel — always scopes token to `github.event.repository.name`

[bshore-bf]

Summary

When using github-app: with repositories: ["*"] in a workflow_call reusable workflow, the activation job's "Generate GitHub App token for activation" step always emits repositories: ${{ github.event.repository.name }}, scoping the token to the caller repo only. This causes a 404 when the activation job tries to checkout the callee repo's .github/.agents folder.

Expected behavior

repositories: ["*"] should be treated as a sentinel (as it is in buildAppTokenMintStep) and the repositories: field should be omitted from the activation step, granting org-wide access to all repos the App is installed on.

Actual behavior

buildActivationAppTokenMintStep unconditionally writes repositories: ${{ github.event.repository.name }} regardless of the configured  repositories:  value. (https://github.com/github/gh-aw/blob/v0.82.9/pkg/workflow/safe_outputs_app_config.go#L503-L504)

Reproduction

github-app:
  app-id: "12345"
  private-key: ${{ secrets.MY_PEM }}
  repositories: ["*"]
on:
  workflow_call:
    inputs:
      repository:
        type: string
        required: true

Compiled with v0.82.9. The mcp and safe-outputs token mint steps correctly omit  repositories:  with the  ["*"]  sentinel, but the activation step does not.

Workaround

None available via frontmatter. The generated  .lock.yml  must be manually patched after each compile (not viable long-term).