Standardize checkout-as-app in check.yaml format job

[nsheaps]

Summary

• Replaced the separate Checkout Code (actions/checkout) + Authenticate as GitHub App (local ./.github/actions/github-app-auth composite) steps in .github/workflows/check.yaml's format job with the single centralized nsheaps/github-actions/.github/actions/checkout-as-app step (pinned SHA), matching the pattern already used in nsheaps/ai-mktpl and nsheaps/agents/test.yaml. Kept fetch-depth: '0' and added ref: ${{ github.head_ref || github.ref }} since this job pushes formatting fixes back to the PR/push branch. Kept step id auth so downstream references didn't need to change.
• Simplified the downstream stefanzweifel/git-auto-commit-action step to use steps.auth.outputs.user-email directly instead of manually synthesizing a noreply email from user-id + user-name — the centralized action already provides user-email.
• Left the autofix-and-push logic (mise run format + git-auto-commit-action) unchanged.
• Deleted the now-unreferenced local composite action at .github/actions/github-app-auth/ (only action.yml) — confirmed no remaining references to ./.github/actions/github-app-auth anywhere in .github/workflows/*.yaml. Note: pr-status-dispatch.yaml uses the unrelated remote nsheaps/github-actions/.github/actions/github-app-auth action, which is untouched.
• These workflow files are not part of the org's active file-sync (ansible/config/sync-files.yml), so this fix is made directly in this repo.

Why this took a while to go green

This PR's own diff was correct from the start, but main's check.yaml had two unrelated, pre-existing failures that blocked every PR in the repo (not just this one):

1. cspell — Casks/nsheaps-base.rb used "customizer" and Formula/dotfiles.rb used "libexec" ×3, neither in the project dictionary. Fixed directly on this branch (added both words to .config/cspell/project.txt).
2. checkov — two findings unrelated to this PR's diff:
   • CKV_GHA_7 on apply-repo-settings.yaml's workflow_dispatch dry-run input (a template centrally synced from nsheaps/.github) — fixed at the source: nsheaps/.github#205.
   • CKV2_GHA_1 (missing top-level permissions:) on dispatch-review.yaml — also centrally synced from nsheaps/.github; fixed at the source: nsheaps/.github#206 (plus a companion fix to the doc-only mirror in nsheaps/agents#324). An earlier attempt to patch this directly in this repo (#722) was closed unmerged once it was clear the file is centrally synced and a local edit would just get overwritten.

Once #205 and #206 merged and nsheaps/.github's sync propagated the fixes to this repo's main, this branch was rebased onto main and both Format and Security are now green.

Test plan

• CI (check.yaml) runs green on this PR — both Format and Security
• Confirm release.yaml's release job still authenticates correctly and steps.auth.outputs.token is available to the Run release-it step (verify on next push to main after merge)

---

Generated by Claude Code

[nsheaps]

CI red on Format — investigated. Two things happened in that run:

1. Prettier reformatted this PR's edited .github/workflows/check.yaml by 1 line; the job's own self-correcting pattern auto-committed that (8c6818b) and intentionally exited 1 to trigger a re-run. That's expected, working-as-designed behavior, not a bug in this PR's change.
2. cspell flagged "customizer" (Casks/nsheaps-base.rb) and "libexec" ×3 (Formula/dotfiles.rb) as unknown words — files this PR never touches.

Confirmed (2) is pre-existing and unrelated to this PR: check has been failing on main for at least the last 5 runs, including the current HEAD (c8f675e5, https://github.com/nsheaps/homebrew-devsetup/actions/runs/31266973972). Not fixing it here since it's outside this PR's scope — will re-check once main's check workflow recovers.

---

Generated by Claude Code

---

Generated by Claude Code

[nsheaps]

Update: the Security check also failed on this PR's latest run — confirmed pre-existing and unrelated to this PR (this job doesn't even use the auth step this PR changed; it's a plain checkout + parallel security linters). Same commit on main (c8f675e5) already fails both Format and Security for the same reasons. No action needed here; will re-check both once main recovers.

---

Generated by Claude Code

---

Generated by Claude Code