Backport #39007 by @bircni
Reject public-only tokens for repository migrations and require
repository scope for canonical organization repository creation. This
aligns both routes with the existing token authorization boundaries.
_Assisted-by: Codex:GPT-5_
Co-authored-by: bircni <bircni@icloud.com>