GitHub created the App. Now take the key.

cat > create-app.sh <<'EOF'
#!/usr/bin/env bash
# create-app.sh — exchange one-time GitHub App manifest codes for Assay App
# private keys. One OR MORE (role, code) pairs, all in a single run:
#
#   ./create-app.sh <role> <code> [<role> <code> ...]
#
# Each <code> is the value after code= in the address bar GitHub sent you to
# (https://assay.guide/apps-created.html?code=...). A code is single-use and
# expires about an hour after GitHub issued it; if a pair fails with no key,
# delete that half-made App on GitHub and create it again.
#
# For each pair this posts the code to GitHub's manifest-conversion endpoint
# from YOUR machine and nowhere else, writes the returned private key to
# ~/.config/assay/<role>-app.pem at mode 0600, records the App id in
# ~/.config/assay/apps.env, and deletes the raw response (which also carries a
# client secret you never use). One generic script, reused for all eight roles.
set -euo pipefail
umask 077

usage() {
  cat >&2 <<'USAGE'
usage: ./create-app.sh <role> <code> [<role> <code> ...]
  <role>  one of: reviewer worker verifier desk issue-loop intake-loop board-writer promote
  <code>  the one-time code from the address bar after GitHub created that App
  Pass as many role/code pairs as you like — all eight in one run.
USAGE
}

valid_role() {
  case "$1" in
    reviewer|worker|verifier|desk|issue-loop|intake-loop|board-writer|promote) return 0 ;;
    *) return 1 ;;
  esac
}

args=("$@")
n=${#args[@]}
if [ "$n" -eq 0 ] || [ $((n % 2)) -ne 0 ]; then
  echo "create-app.sh: expected role/code pairs (an even number of arguments), got $n." >&2
  usage
  exit 2
fi

# Pass 1 — validate every pair BEFORE any network call, so a typo in the last
# pair does not leave you half-done.
i=0
while [ "$i" -lt "$n" ]; do
  role=${args[$i]}
  code=${args[$((i + 1))]}
  if ! valid_role "$role"; then
    echo "create-app.sh: unknown role: $role" >&2
    usage
    exit 2
  fi
  if [ -z "$code" ]; then
    echo "create-app.sh: the code for role $role is empty." >&2
    usage
    exit 2
  fi
  i=$((i + 2))
done

conf=$HOME/.config/assay
mkdir -p "$conf"

tmpfiles=()
cleanup() {
  if [ "${#tmpfiles[@]}" -gt 0 ]; then rm -f "${tmpfiles[@]}"; fi
}
trap cleanup EXIT

exchange_one() {
  role=$1
  code=$2
  env_key=$(printf '%s' "$role" | tr 'a-z-' 'A-Z_')_APP_ID

  json=$(mktemp)
  tmpfiles+=("$json")

  if ! curl -sS -X POST -H 'Accept: application/vnd.github+json' \
       "https://api.github.com/app-manifests/$code/conversions" > "$json"; then
    echo "create-app.sh: network error exchanging the code for role $role." >&2
    rm -f "$json"
    return 1
  fi

  if ! jq -e .pem "$json" >/dev/null 2>&1; then
    echo "create-app.sh: no key for role $role — its code was already used or has expired." >&2
    echo "Delete that half-made App on GitHub and create it again." >&2
    rm -f "$json"
    return 1
  fi

  pem=$conf/$role-app.pem
  jq -r .pem "$json" > "$pem"
  chmod 600 "$pem"

  app_id=$(jq -r .id "$json")
  slug=$(jq -r .slug "$json")
  rm -f "$json"   # the response also holds a client secret

  printf '%s=%s\n' "$env_key" "$app_id" >> "$conf/apps.env"
  echo "Saved  $pem  (mode 0600)  -  $slug  app id $app_id"
  echo "  install:  https://github.com/apps/$slug/installations/new"
  return 0
}

# Pass 2 — exchange each pair. A failed pair is reported and the run continues
# to the next, so one spent code does not abandon the others.
failed=0
i=0
while [ "$i" -lt "$n" ]; do
  if exchange_one "${args[$i]}" "${args[$((i + 1))]}"; then :; else failed=1; fi
  i=$((i + 2))
done

if [ "$failed" -ne 0 ]; then
  echo "create-app.sh: one or more exchanges failed (see above)." >&2
  exit 1
fi

echo "Done. Re-resolve your desk tools (for example /plugin) so the new Apps are picked up."
EOF
chmod +x create-app.sh

./create-app.sh <role> <code>

# pick a role in each App tab; the collected command appears here