[datlechin]

• og.yml runs in the web-bot environment; its GITHUB_TOKEN drops to contents: read.
• Replaces the direct push to main (git-auto-commit) with a tablepro-web-bot token and create-pull-request on bot/og-cards: signed commit, only public/og/** and public/og.png.
• Pins checkout v7.0.1, create-github-app-token v3.2.0 and create-pull-request v8.1.1 to commit SHAs.
• docs/deployment.md: new "The web bot" section (permissions, credentials, rotation, no ruleset bypass); the social cards steps now say the workflow opens a PR.
• WorkflowsTest: no workflow gives GITHUB_TOKEN write access, and every create-pull-request step takes its token from an earlier create-github-app-token step.