ci: use SYNC_TOKEN (workflow scope) for upstream sync push

The default GITHUB_TOKEN is blocked by GitHub from pushing commits that
touch .github/workflows/, which broke the auto-sync push step once the
fork carried its own workflow files. Use a PAT with repo+workflow scope
(SYNC_TOKEN secret), falling back to GITHUB_TOKEN when unset.

Author: gburd

.github/workflows/sync-upstream-manual.yml

@@ -21,7 +21,10 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # PAT with repo + workflow scope. The default GITHUB_TOKEN cannot push
+          # commits that touch .github/workflows/ (platform block). See SYNC_TOKEN
+          # repo secret.
+          token: ${{ secrets.SYNC_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Configure Git
         run: |

.github/workflows/sync-upstream.yml

@@ -18,7 +18,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # PAT with repo + workflow scope. The default GITHUB_TOKEN cannot push
+          # commits that touch .github/workflows/ (platform block). See SYNC_TOKEN
+          # repo secret. Falls back to GITHUB_TOKEN if unset (push will fail on
+          # workflow-file changes, but non-workflow syncs still work).
+          token: ${{ secrets.SYNC_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Configure Git
         run: |