It would be a bit complicated to implement and explain to end-users, but maybe there's a path here where you're allowed to set unexpiring tokens but only if the scopes they have are tightened beyond a specific level?

A system that says "sure, you can have a token that doesn't expire if all you are doing is repository_dispatch" would be really useful to me too.