* ci(cso): give the promote candidate step GH_TOKEN, and fail any workflow step that runs gh without a token
Promote run 39691485727 failed after its cso-runtime-release approval:
"Generate a fail-closed catalog candidate" calls gh api .../compare with no
GH_TOKEN, and gh on a hosted runner exits 4. test/workflow-gh-token.test.ts
scans every workflow step that invokes gh for a token in step, job or
workflow env.
* changelog: promote workflow GH_TOKEN fix
* v1.91.177.0 stamp
