ci(release): give the pr step the GITHUB_TOKEN its tool reads, and run e2e tools with their workflow env

[systemfsoftware-maker]

Summary

stryker-js-effect Release run 37726347961 bumped, committed (as github-actions[bot]) and pushed changeset-release/main, then failed creating the PR:

ERROR: creating pull request for changeset-release/main into main in systemfsoftware/stryker-js-effect failed: Requires authentication

The reusable release.yml gave the github-release-management pr step GH_TOKEN (:76 on fd4ce35), but the tool reads only process.env['GITHUB_TOKEN'] (apps/github-release-management/src/main.ts:78). Every other tool step (:51, :108, :121) passes GITHUB_TOKEN.

Fix

• release.yml: the pr step now passes GITHUB_TOKEN: ${{ github.token }}. The gh workflow run dispatch step keeps GH_TOKEN, which the gh CLI reads. No token-name fallback in the tool: git grep GH_TOKEN finds no other caller passing it to a tool.
• Guard for the class, in the e2e lane. The e2e harness exported GITHUB_TOKEN to every command, which is why the containerised pipeline passed with the broken step. world.tool(app, sub, args) now runs with only the runner's own defaults (GITHUB_API_URL, GITHUB_REPOSITORY, NO_COLOR) plus the env: of the release.yml step that runs the same app, subcommand and flag names. e2e/workflow-env.ts reads release.yml (decoded through e2e/workflow.schema.ts), finds every nix develop --command <app> <sub> ... step, and resolves ${{ github.token }} to the emulator's token; an unknown expression throws. So any tool step that lacks a variable its tool reads now fails pnpm --filter @systemfsoftware/e2e test, the E2E workflow, exactly as it would on a runner. Calls with no matching step shape (the fixture's 1.0.0 seed tag) get the env of the steps running that subcommand.

Failing before

Commits 411d245/e6f0f76 carry the guard without the workflow fix.

• CI: E2E 37727594151 on 411d245 failed at e2e/tests/pipeline.integration.test.ts:271 (expect(opened.code).toBe(0) after github-release-management pr).
• Local, same lane: the pr command record had env: {"GH_TOKEN":"test_token_admin"}, exit 1, and printed

  ERROR (#1): Error: creating pull request for changeset-release/main into main in admin/fixture failed: Requires authentication - https://emulate.dev/github
  

  the same error as the stryker Release run.

After the fix (a6ac68c), locally: pnpm --filter @systemfsoftware/e2e test passed (1/1); both pr calls ran with env: {"GITHUB_TOKEN":"test_token_admin"} and exited 0. pnpm check:ci exit 0 (72/72, 17/17), dprint check exit 0.

Orphan branch

changeset-release/main on stryker-js-effect is at 5a7bb104 (github-actions[bot]) with no open PR. On the next run pr decides Vacant (no open PR for the branch), commits the freshly bumped tree and pushes with git push --force origin HEAD:refs/heads/changeset-release/main, then creates the PR. So the orphan is refreshed (overwritten) by the bot's own push, not reused as-is; no manual cleanup is needed.

No changeset: only the workflow and the private e2e package change. No stryker lock bump: the stryker caller uses release.yml@main. No file overlap with #28. Nothing was run with stryker.

[kiro-systemf]

Verified: 5/5 green on a6ac68c; the env-contract guard fails E2E on 411d245 with the exact 'Requires authentication' error; the pr step now gets GITHUB_TOKEN.