runtime-build.yml STAGE 1 broken: GH_PAT authentication failure cloning claude-configs

[cbeaulieu-gt]

runtime-build.yml's STAGE 1 — clone + validate job fails cloning glitchwerks/claude-configs at its pinned ref:

remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/glitchwerks/claude-configs/'
##[error]Process completed with exit code 128.

Timeline:

• Last successful runtime-build.yml run: 2026-05-15T01:38:56Z
• No runs (any branch) between 2026-05-16 and 2026-07-17
• First run after the gap (PR chore: sunset automated Claude PR-review gate #310, 2026-07-18) fails at the clone step

This is pre-existing, not caused by any specific PR — the failing PR (#310) doesn't touch runtime/ci-manifest.yaml, the clone logic, or GH_PAT usage at all. The GH_PAT org secret likely expired during the 2-month gap with no runs to surface it. This will block STAGE 1 (and everything downstream — build/push/smoke) on any future PR or push touching runtime/**, not just #310.

Fix: rotate/reissue the GH_PAT organization secret (per this repo's CLAUDE.md § CI Runtime, it needs repo:read scope on glitchwerks/claude-configs and org-level provisioning so other repos can reuse it). I did not inspect or touch the secret itself — this needs manual rotation via GitHub Settings → Secrets → Actions.

Discovered while verifying CI on PR #310 (unrelated sunset-of-claude-pr-review change) — flagging separately since it's a distinct infra issue.

🤖 Generated by Claude Code on behalf of @cbeaulieu-gt