fix(ci): authenticate JetBrains metadata requests

[marius-kilocode]

JetBrains CI generates the OpenAPI client from the pinned CLI release before compiling and running tests. The Gradle task already reads GH_TOKEN or GITHUB_TOKEN, but GitHub Actions does not expose ${{ github.token }} as either environment variable automatically. Cold runs therefore query GitHub release metadata anonymously and can exhaust the 60-request-per-hour unauthenticated limit.

This change maps the workflow's ephemeral ${{ github.token }} to the existing GH_TOKEN input for the JetBrains test process. The reusable workflow grants only contents: read, checks: write, and pull-requests: read; the token is not persisted and test behavior is unchanged.

The original Windows runner disconnect was separately confirmed as a Blacksmith control-plane failure: the same shard passed unchanged on rerun and on the post-merge main workflow. No repository workaround for that infrastructure event is included in this PR.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• .github/workflows/test-jetbrains.yml

Previous Review Summary (commit 85d8fae)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 85d8fae)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/test-jetbrains.yml
• .github/workflows/test.yml

---

_{Reviewed by gpt-5.6-sol-20260709 · Input: 31.3K · Output: 4.6K · Cached: 214.8K}

_{Review guidance: REVIEW.md from base branch main}