tools/setup-submitter <owner>/<repo> creates winget-bot if needed, as a restricted user that can create no repositories or organizations, makes it a write collaborator here, restricts merging to main to jeff, makes a token for that one program limited to this repository, stores it as the program's WINGET_BOT_TOKEN, and checks what the token can and cannot do. The token has read:user beside write:repository and write:issue, because jeff/winget-submit reads its own user to author the commit. The wizard library above its STAGES marker is from mattpocock/skills, unchanged. Refs #8 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw