fix(ci): inject GitHub token into Gitee repair tag verification

[PeterGuy326]

Background

The dedicated Gitee repair dispatch for v1.0.53-beta.4 failed before making any request to Gitee:

• Run: https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/runs/29714234895
• Failed job: Mirror an existing immutable release to Gitee
• Failed step: Fetch and verify sealed release tag

The Gitee release itself has since been synchronized manually with the repository's existing idempotent release scripts. This issue tracks the CI defect so future repairs work without manual intervention.

Root cause

The repair-only Fetch and verify sealed release tag step invokes scripts/release/verify-github-tag-authority.sh, which calls gh, but that step does not provide GH_TOKEN or GITHUB_TOKEN.

Observed failure:

gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable.
Process completed with exit code 4.

This happened before Gitee authentication or upload, so it was not caused by GITEE_TOKEN, GITEE_USER, or GITEE_REPO.

Proposed fix

• Inject GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} into the repair-only tag verification step.
• Audit the repair path for any other scripts that transitively invoke gh without an explicit token.
• Add a focused workflow/policy regression check so repair steps using GitHub CLI cannot omit authentication.

Acceptance criteria

• A repair_gitee_version dispatch for an existing immutable prerelease passes tag authority verification.
• The repair verifies the exact tag object and peeled commit before downloading assets.
• The repair reuses the existing immutable GitHub Release and does not rebuild or republish it.
• Gitee synchronization remains idempotent: matching assets are skipped and every expected asset is SHA-verified.
• Release delivery gate is green for the repair mode.
• No token value is printed in Actions logs.