fix: use GH_TOKEN env var for gh api PAT auth [skip-version]

- gh uses GITHUB_TOKEN by default, ignoring --header flag
- Set GH_TOKEN env var so gh uses the PAT for all API calls
- This enables cross-repo tag creation

Author: localpibox

.github/workflows/build-and-publish.yml

@@ -139,6 +139,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ steps.bump.outputs.version }}
+          GH_TOKEN: ${{ secrets.LOCALPIBOX_PAT }}
         run: |
           set -e
           # repo -> default branch mapping
@@ -154,14 +155,13 @@ jobs:
             echo "Tagging $repo@$VERSION (from $branch)"
             sha=$(git ls-remote "https://github.com/$repo.git" "refs/heads/$branch" | awk '{print $1}')
             if [ -n "$sha" ]; then
-              # Create lightweight tag using PAT (GITHUB_TOKEN is scoped to devstack only)
+              # GH_TOKEN env var makes gh use PAT for all API calls
+              # Create lightweight tag: POST to /git/refs/{ref} with sha body
               if gh api "repos/$repo/git/refs/refs/tags/$VERSION" \
                   --method POST \
-                  -f sha="$sha" \
-                  --header "Authorization: token $LOCALPIBOX_PAT" \
-                  2>/dev/null; then
+                  -f sha="$sha"; then
                 echo "  ✅ $repo@$VERSION"
-              elif gh api "repos/$repo/git/ref/tags/$VERSION" --header "Authorization: token $LOCALPIBOX_PAT" 2>/dev/null > /dev/null; then
+              elif gh api "repos/$repo/git/ref/tags/$VERSION" 2>/dev/null > /dev/null; then
                 echo "  ✅ $repo@$VERSION (already exists)"
               else
                 echo "  ⚠️  $repo tag creation failed"