Module app 

GitHub App authentication and the review gate that reads App reviews.

The owner token resolver stays in token.rs. This module signs a short-lived JWT, exchanges it for an installation token, and decides which reviews count.

Functions

start_loader

Reads the App key in the background, once per daemon start. A passbox key waits on Touch ID, so the engine runs on the owner token and comment reviews until the read succeeds