feat: add GitHub token to ArgoCD repo credentials to avoid API rate limiting on fresh deployments

## Problem

On fresh workshop event deployments, ArgoCD fetches the `aws-samples/appmod-blueprints` public repo using unauthenticated GitHub API calls (60 req/hr limit). When multiple events are created simultaneously, the rate limit is hit quickly, causing ArgoCD's root ApplicationSet to fail generating child apps. This manifests as:

```
1 apps so far, waiting... (repeated for 5+ minutes)
```

ArgoCD eventually recovers once the rate limit window resets, but adds 5-10 minutes to the install time.

## Proposed Solution

Use a **GitHub App** at the org level (preferred) or a fine-grained PAT from a service/bot account, stored in AWS Secrets Manager, and applied as an ArgoCD repository credential in `hub:seed`.

### Implementation

1. Create a GitHub App in `aws-samples` org with read-only access to `appmod-blueprints` repo
2. Store app credentials (app ID + private key) in CDK-managed Secrets Manager secret
3. In `hub:seed`, create an ArgoCD `repository` type secret with the GitHub App credentials:

```yaml
apiVersion: v1
kind: Secret
metadata:
name: appmod-blueprints-repo
namespace: argocd
labels:
argocd.argoproj.io/secret-type: repository
stringData:
type: git
url: https://github.com/aws-samples/appmod-blueprints
githubAppID: ""
githubAppInstallationID: ""
githubAppPrivateKey: ""
```

This increases the rate limit from 60/hr (unauthenticated) to 5000/hr (GitHub App).

### Alternative (simpler)

Use a fine-grained PAT from a `aws-samples` service/bot account with read-only access to public repos. Store in Secrets Manager, apply as ArgoCD repo credential with `username`/`password` auth.

## Impact

- Affects: fresh crossplane/kro-ack workshop deployments
- Severity: low (self-heals after ~5-10min)
- Frequency: only when multiple events created simultaneously

Start with the hub:seed configuration and the CDK-managed AWS Secrets Manager setup described in the issue. Determine how the GitHub App credentials should be stored and exposed as an ArgoCD repository secret, then verify that fresh workshop deployments fetch appmod-blueprints without unauthenticated API rate limiting.

Written by the indexing model from the issue text.