fix: DEV_KIT_BOT_APP_PRIVATE_KEY is not a valid private key #58

What

renovate-dev-kit-lock fails to mint the dev-kit-bot token on its first real run (opendefensecloud/solution-arsenal#862, job):

Failed to create token for "opendefensecloud/solution-arsenal" (attempt 1): Invalid keyData
  [cause]: Error: error:0680008E:asn1 encoding routines::not enough data

The relock step itself passed (changed=true); only the token step fails, so no flake.lock commit lands and the PR stays red.

Why it surfaced only now

The secrets were set up with #41 (around 2026-10-02) but never used: the token step runs only when a relock changes the lock, and this is the first time one did. No dev-kit-bot[bot] commit exists in the org yet.

The error means the secret holds no complete PEM key: truncated when pasted, or a different value (client ID, key fingerprint). It is set and visible to Solar, since an empty secret fails earlier.

Fix (org admin)

1. Use the app's .pem, or generate a new key in the dev-kit-bot app settings.
2. openssl pkey -in dev-kit-bot.pem -noout
3. Set it from the file, keeping the current repo access: gh secret set DEV_KIT_BOT_APP_PRIVATE_KEY --org opendefensecloud --repos dev-kit,solution-arsenal < dev-kit-bot.pem
4. Check DEV_KIT_BOT_APP_CLIENT_ID holds the app's Client ID (Iv…).
5. Re-run the failed job on #862; delete any superseded key in the app settings.

Acceptance criteria

• The relock job on #862 commits chore(deps): relock go-overlay in flake.lock as dev-kit-bot[bot], verified.
• Renovate keeps the branch as its own (not marked edited).

Unblocks extending the app to the other consumers (asked in solution-arsenal#825) and opendefensecloud/renovate-config#19.