fix(ci): add fallback for GITHUB_PAT_TOKEN_NSHEAPS

Use github.token as fallback when PAT secret isn't available

Author: claude

.github/workflows/cd.yaml

@@ -50,7 +50,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_PAT_TOKEN_NSHEAPS }}
+          # Use PAT for pushing, fallback to github.token
+          token: ${{ secrets.GITHUB_PAT_TOKEN_NSHEAPS || github.token }}
 
       - name: Install mise
         run: |

.github/workflows/ci.yaml

@@ -22,7 +22,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_PAT_TOKEN_NSHEAPS }}
+          # Use PAT for pushing back to branch, fallback to github.token for PRs from forks
+          token: ${{ secrets.GITHUB_PAT_TOKEN_NSHEAPS || github.token }}
 
       - name: Install mise
         run: |