chore(build): reduce GitHub Actions secret usage

[arturcic]

Summary

This PR reduces GitHub Actions secret usage by preferring built-in credentials where possible and keeping elevated tokens only where required.

What Changed

• Replaced PUSH_GITHUB_TOKEN usage with GITHUB_TOKEN for same-repository write paths.
• Replaced DOCKER_GITHUB_TOKEN usage with GITHUB_TOKEN in reusable Docker workflows.
• Moved ENABLED_DIAGNOSTICS from secrets context to repository variables in CI.
• Tightened RELEASE_GITHUB_TOKEN usage to dispatch and cross-repository paths that still require PAT behavior.
• Added explicit workflow and job permissions for built-in token write operations.

Files Updated

• .github/workflows/public-api.yml
• .github/workflows/mkdocs.yml
• .github/workflows/_docker.yml
• .github/workflows/_docker_manifests.yml
• .github/workflows/ci.yml
• .github/workflows/docs.yml

Validation

• Confirmed there are no remaining workflow references to:
  • secrets.PUSH_GITHUB_TOKEN
  • secrets.DOCKER_GITHUB_TOKEN
  • secrets.ENABLED_DIAGNOSTICS
• Confirmed remaining RELEASE_GITHUB_TOKEN references are intentional for dispatch and cross-repository scenarios.
• Created repository variable ENABLED_DIAGNOSTICS with value false because GitHub does not allow empty variable values.

Notes

• Environment scoping follow-up work is tracked separately.

Closes #4855

[Copilot]

Pull request overview

This PR reduces reliance on high-privilege GitHub Actions secrets by switching routine same-repo write operations to the built-in GITHUB_TOKEN, moving a diagnostics toggle from secrets to vars, and adding explicit workflow/job permissions where write access is required.

Changes:

• Replace PUSH_GITHUB_TOKEN / DOCKER_GITHUB_TOKEN usage with the built-in GITHUB_TOKEN / github.token for same-repo operations.
• Move ENABLED_DIAGNOSTICS from secrets to vars in CI.
• Add/adjust explicit permissions blocks for jobs that need write access (contents/packages/attestations).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/public-api.yml	Removes custom checkout token and enables contents: write so the workflow can push with the built-in token.
.github/workflows/mkdocs.yml	Removes custom checkout token and adds workflow-level contents: write for pushing snippet updates.
.github/workflows/docs.yml	Uses github.token instead of RELEASE_GITHUB_TOKEN for docs publishing and scopes contents: write to the publish job.
.github/workflows/ci.yml	Moves diagnostics flag to vars and uses github.token for release steps while keeping PAT only for dispatch.
.github/workflows/_docker_manifests.yml	Switches GHCR password input from a PAT secret to the built-in token.
.github/workflows/_docker.yml	Switches GHCR password input from a PAT secret to the built-in token.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[mergify]

Thank you @arturcic for your contribution!