fix: authenticate private autofix fetches

[jan-kubica]

Summary

• provide the read-only workflow token to the autofix action through process-scoped Git configuration
• keep checkout credentials non-persistent and repository permissions read-only
• mask the derived Basic authorization value before exporting it to the action step
• enforce the private-fetch and least-privilege contract in workflow tests

Validation

• node --test .github/workflows/*.test.mjs (25 passed)
• actionlint .github/workflows/*.yml
• git diff --check origin/main...HEAD

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T12:51:36.508877Z	2326e2b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.