Scope gh-aw GitHub tokens to suppress magic fallback secret names

[jonathanpeppers]

Summary

Scopes the gh-aw GitHub tokens for .github/workflows/android-tools-reviewer.md so the compiled lock file no longer references the gh-aw "magic" fallback secret names GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN. A repo secret-audit was flagging those names purely by their appearance in the lock file's Secrets used: comment block — they were optional fallback chain entries, not actually required.

Two small frontmatter additions (one github-token under tools.github, one under safe-outputs, both pointing at ${{ secrets.GITHUB_TOKEN }}) make the gh-aw compiler resolve the token explicitly and stop emitting the fallback names.

This matches the change merged in dotnet/java-interop#1475 and the equivalent dotnet/android branch — same gh-aw compiler version (v0.79.8).

Before / after — Secrets used: block

Before:

# Secrets used:
#   - COPILOT_GITHUB_TOKEN
#   - GH_AW_GITHUB_MCP_SERVER_TOKEN
#   - GH_AW_GITHUB_TOKEN
#   - GITHUB_TOKEN

After:

# Secrets used:
#   - COPILOT_GITHUB_TOKEN
#   - GITHUB_TOKEN

Verification

• gh aw compile ran clean: 0 error(s), 0 warning(s).
• Grepped the entire lock file body — no remaining references to GH_AW_GITHUB_TOKEN or GH_AW_GITHUB_MCP_SERVER_TOKEN.
• Diff stat shows only the two intended files changed (.md + .lock.yml); no whitespace-only churn.

[Copilot]

Pull request overview

This PR updates the gh-aw workflow frontmatter so the compiler resolves the GitHub token explicitly and stops emitting optional “magic fallback” secret names (GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN) into the generated lock file’s Secrets used: block, avoiding false positives in secret-audit tooling.

Changes:

• Added explicit github-token: ${{ secrets.GITHUB_TOKEN }} configuration to the workflow’s tools.github and safe-outputs frontmatter.
• Regenerated the .lock.yml so token expressions no longer include the fallback secret chain and the manifest secrets list only includes COPILOT_GITHUB_TOKEN and GITHUB_TOKEN.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/android-tools-reviewer.md	Adds explicit github-token entries so gh-aw doesn’t rely on/emit fallback secret names.
.github/workflows/android-tools-reviewer.lock.yml	Regenerated output reflecting the explicit token configuration; removes fallback secret references from manifest/comments and runtime env/inputs.