Recognize caller GITHUB_TOKEN for native task publication

[chubes4]

Problem

The hosted native Docs Agent run now reaches execute-native-agent-task.mjs, but fails before execution because the request requires an access token while the workflow reports ACCESS_TOKEN_CONFIGURED=false. The job has a valid caller-scoped GITHUB_TOKEN with contents, pull-requests, and issues write permissions.

Evidence: https://github.com/Automattic/build-with-wordpress/actions/runs/29293335972

The workflow passes the effective token to GITHUB_TOKEN, but configuration validation only recognizes an explicitly named ACCESS_TOKEN secret. This incorrectly requires a redundant PAT for same-repository checkout/publication.

Required outcome

• Treat the effective caller-scoped github.token as configured for same-repository access/publication.
• Require explicit ACCESS_TOKEN only for a concrete cross-repository target that the caller token cannot access.
• Validate the token target against target_repo; do not broaden repository scope.
• Keep publication tools constrained by allowed_repos.
• Add hosted-workflow contract coverage for built-in-token success, missing-token failure, and cross-repository explicit-token behavior.
• Preserve secret redaction and never serialize either token.

This must land before the WP Codebox release used by Docs Agent consumers.