ci: fetch private tramiton dep via ephemeral Actions token, not a PAT

sharang/tramiton lists sharang as a Collaborative Owner (tramiton → Settings →
Actions), so this repo's Actions can read tramiton. Use ${{ github.token }} in
the git credential rewrite instead of a TRAMITON_FETCH_TOKEN PAT — no secret to
manage. If cargo's git fetch 403s (feature scoped to uses:-actions only), fall
back to a PAT.

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -50,13 +50,14 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a read token so the
-      # runner can fetch it. Requires a repo secret TRAMITON_FETCH_TOKEN — a
-      # Gitea PAT for a user with read access to sharang/tramiton.
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions
+      # token so the runner can fetch it — no PAT needed. This works because
+      # sharang/tramiton lists sharang as a Collaborative Owner (tramiton →
+      # Settings → Actions), which lets this repo's Actions read tramiton.
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \
             "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""