ci: use releases token for engine lookup

[intel352]

Summary

• prefer RELEASES_TOKEN for cross-repo Workflow release lookup in IaC conformance
• fall back to github.token when the org secret is unavailable

Verification

• actionlint .github/workflows/iac-host-conformance.yml

Addresses the post-merge review note from #94.

[intel352]

iac-codemod refactor-apply report

Mode: dry-run
Sites: 1
Errors: 0

Skipped (// wfctl:skip-iac-codemod)

• internal/provider.go:255 DOProvider.Apply skipped

Full report (90-day retention) attached as workflow artifact.

[Copilot]

Pull request overview

Updates the IaC host conformance GitHub Actions workflow to prefer an org/repo secret token for cross-repo Workflow engine release lookup, while falling back to the default workflow github.token when the secret isn’t available.

Changes:

• Set GH_TOKEN to ${{ secrets.RELEASES_TOKEN || github.token }} for the “Determine Workflow engine versions” step so gh release view --repo GoCodeAlone/workflow ... can authenticate with a broader-scoped token when present.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.