Identify the board App by client-id, which app-id is deprecated in favour of

[rocklambros]

Small follow-up to #157 and #158, from the first live run rather than from review.

The dry-run dispatch completed green and annotated itself twice:

Input 'app-id' has been deprecated with message: Use 'client-id' instead.

BOARD_APP_CLIENT_ID is already set on the board-automation environment. BOARD_APP_ID stays in place, so reverting this needs no settings change. Neither value is a secret and both identify the same App, so this is a rename rather than a change of trust.

Worth doing now because the warning is currently only a warning. The alternative is discovering which release of the action turns it into a failure at 04:40 UTC on a night when the board has drifted.

Separately, a least-privilege cleanup for you

The App was granted one permission more than it needs. Its live grant reads:

issues:               read    <- needed
pull_requests:        read    <- needed
organization_projects: write  <- needed, this is the one that reaches project 9
metadata:             read    <- mandatory, granted automatically
repository_projects:  write   <- not needed

repository_projects covers repository-scoped classic projects. The reconciler never touches one: it calls gh issue list, gh pr list, and two ProjectV2 GraphQL mutations against the organization project. Removing it in the App settings costs nothing and does not require reinstalling.

Installation is correctly scoped to selected repositories.

[github-actions]

Thanks for this. It is queued rather than ignored.

This pull request does not reference an issue carrying status:accepted, so a maintainer has not looked at it yet and will not until the underlying issue is triaged. Nothing here is rejected. See Current Priority Scope for what the project is working on, and help wanted for work that is already accepted.

If this is an editorial correction, tick that box in the description and this comment stops applying.