Plumb-through token

.gitea/workflows/mirror.yaml

@@ -15,6 +15,8 @@ jobs:
       # and name directly from the context.
       # I'm leaving that off because it'd require a whole other step (to pipe `github.repository` through a splitting
       # tool, because there's only `github.repository_owner`, no `github.repository_name`)
+      #
+      # (And the token should be retrieved from Vault)
       - uses: https://gitea.scubbo.org/scubbo/commit-report-sync@main
         with:
           target_repo_domain: github.com
@@ -23,4 +25,4 @@ jobs:
           source_repo_domain: gitea.scubbo.org
           source_repo_owner: scubbo
           source_repo_name: commit-report-sync-testbed
-    
+          target_repo_token: ${{ secrets.PAT_FOR_GITHUB_SYNC }}