fix(ci): use GITHUB_TOKEN for sync checkout, PAT only for push

[cursor]

Summary

Fixes sync failure from run #27459818134 (issue #15).

The scheduled sync failed at Checkout fork (full history) with:

fatal: could not read Username for 'https://github.com': terminal prompts disabled

actions/checkout was configured with token: ${{ secrets.SYNC_PUSH_TOKEN }}. When the PAT is empty or expired, checkout fails before any rebase/test steps run — producing failed_step: unknown.

Fix

• Checkout uses the default GITHUB_TOKEN (read + sufficient for fetch).
• Push step gets a new "Configure push credentials" step that applies SYNC_PUSH_TOKEN to the origin remote only when set (preserving PAT-backed workflow-file pushes from rebased ops-overlay).

Verification

• All FEATURE_BRANCHES entries rebase cleanly onto current upstream/main.
• Focused sync tests pass locally: 171 passed (test_pre_gateway_dispatch, test_session, test_plugins).

Recovery for sync-failure issue #15 — merge then re-run sync-upstream.yml.

  

[github-actions]

🔎 Lint report: cursor/hermes-agent-upstream-sync-recovery-2b49 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10857 on HEAD, 10857 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5696 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.