fix(deps): use sync token for staged pin merge

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/advance-staged-qpk-pin.yml

@@ -114,7 +114,7 @@ jobs:
       - name: Queue validated staged pin for merge
         if: steps.guard.outputs.allowed == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.QSL_REPO_SYNC_TOKEN || github.token }}
         run: |
           gh pr merge "${{ steps.pr.outputs.number }}" \
             --repo "$GITHUB_REPOSITORY" \

tests/test_update_qpk_pin_workflow.py

@@ -270,5 +270,6 @@ def test_staged_pin_auto_advance_is_limited_to_verified_machine_prs() -> None:
     assert 'if [ "$files" != "QPK_PIN" ]; then' in workflow
     assert "candidate_is_not_on_main_history" in workflow
     assert "actions/checkout" not in workflow
+    assert "secrets.QSL_REPO_SYNC_TOKEN || github.token" in workflow
     assert "--auto --rebase --delete-branch" in workflow
     assert "--match-head-commit" in workflow