fix(deps): use sync token for staged pin merge

[Pigbibi]

Summary

• Use the already configured QSL repository sync token only for the final validated staged-pin merge request.
• Keep all metadata, file-scope, SHA, and main-history checks unchanged.
• Fix the GitHub Actions default-token permission error observed in the first guarded candidate run.

Validation

• Manually invoked all cases in tests/test_update_qpk_pin_workflow.py because pytest is unavailable on this VPS.
• Ran git diff --check.

No runtime target, deployment, or trading configuration is changed.