ci: use GH_PAT to allow pushing workflow file changes from upstream

GITHUB_TOKEN cannot push .github/workflows/ changes (GitHub blocks it).
A PAT with the `workflow` scope is required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/sync-rebase.yml

@@ -14,13 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      workflows: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GH_PAT }}
 
       - name: Configure git
         run: |