fix(ci): fall back to github.token for the PR label fetch on fork PRs

[beardthelion]

What does this PR do?

Restores CI for pull requests opened from forks. Since 597615a, the ci-review job's "Fetch PR labels" step authenticates with secrets.AUTOFIX_BOT_PAT. Repository secrets are not available to fork-origin pull_request runs, so on every fork PR the token resolves empty, gh exits 1, the retry wrapper fails the job after three attempts, and the "All required checks pass" aggregate goes red regardless of the PR's content.

This falls back to the built-in read-only token when the PAT is unavailable, which is enough for reading labels. Same-repo runs keep using the PAT, and the gate's decision still keys off the ci-reviewed label, which only maintainers can set, so fork PRs gain no new capability from the fallback.

Related Issue

Fixes #66559

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• .github/workflows/lint.yml: the "Fetch PR labels" step's GH_TOKEN now falls back to github.token when secrets.AUTOFIX_BOT_PAT is unavailable (fork-origin runs).

How to Test

1. The failing case is live today: any fork PR run after 597615a fails "Fetch PR labels" with the GH_TOKEN error (examples from three different authors in the linked issue), while same-repo fix(desktop): ban + fix atom-mirrored ref stale-read bug class #66528 passes the same step, confirming the secret-availability mechanism.
2. With this change the expression resolves to the built-in token on fork runs; gh pr view --json labels needs only read access, which that token has.
3. YAML validated by parse; the change is a single expression, no job or step structure touched.

Note: this PR itself edits a CI-sensitive file, so the ci-reviewed gate applies to it, and because it comes from a fork its own ci-review job will keep failing at the broken fetch step until the fix is on main. It needs a maintainer's ci-reviewed label and a merge over the red check.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q: N/A, workflow-only change with no Python surface
• I've added tests for my changes: N/A for workflow YAML
• I've tested on my platform: Ubuntu 24.04 (YAML parse plus live failure evidence from Actions runs)

Documentation & Housekeeping

• I've updated relevant documentation: N/A
• I've updated cli-config.yaml.example: N/A
• I've updated CONTRIBUTING.md or AGENTS.md: N/A
• I've considered cross-platform impact: N/A (hosted-runner workflow)
• I've updated tool descriptions/schemas: N/A

[teknium1]

Thanks for this, @beardthelion — the fork label-fetch fix is exactly right. The AUTOFIX_BOT_PAT swap in #66373 left the label gate reading with an empty token on fork PRs, and github.token fallback is the correct restoration.

We landed the same fallback on the label fetch (plus the detect-changes classifier leg, which had the same fork breakage) in #66577, merged just now as SHA 1e01a4bbe7ebf35cb1452c2e0c95f886dc9c758f. It was built independently against the incoming bug report before I'd swept and found your PR — apologies for not salvaging your branch directly; your fix predated mine and reached the same conclusion. Closing as resolved on main. Appreciate the quick turnaround.