fix: guard GitHub App token setup

[Pigbibi]

Summary

• detect GitHub App credentials in a shell step before creating the installation token
• avoid invalid workflow expressions that reference secrets directly in step if conditions
• keep the new App-first token flow and PAT fallback unchanged otherwise

Verification

• python3 -m unittest tests/test_monthly_optimization_planner_workflow_config.py
• uvx ruff check tests
• ruby YAML parse for .github/workflows/monthly_optimization_planner.yml