fix(ci): use default token for sponsors workflow checkout

[Musiker15]

Summary

Previous run failed in the checkout step:

fatal: could not read Username for 'https://github.com': terminal prompts disabled
The process '/usr/bin/git' failed with exit code 128

Root cause: actions/checkout was given ${{ secrets.SPONSORS_TOKEN }}, but
that secret is a user PAT scoped for the GitHub Sponsors GraphQL API — it has
no contents: write on the repo, so git fetch couldn't authenticate.

The job already declares permissions: contents: write, so the default
GITHUB_TOKEN is exactly what we want for the checkout + push. SPONSORS_TOKEN
now only gates the GraphQL request, which is its actual purpose.

Changes

• Drop with: { token: ${{ secrets.SPONSORS_TOKEN }} } on the checkout step.
• Add User-Agent header (GitHub rejects unidentified GraphQL requests with 403).
• sponsor → sponsorEntity (handles both User and Organization sponsors) and
  inline avatarUrl(size: 60) instead of &s=60.
• Fail fast on empty token / empty org data / missing marker block with
  ::error:: annotations.
• Stop trying to write README_GER.md (doesn't exist).
• Placeholder comment between markers when there are no sponsors.

Test plan

• CI green on this PR
• After merge: manually trigger Update Sponsors in README workflow
  (gh workflow run update-sponsors.yml) and confirm it completes successfully
• Verify the resulting commit only changes the <!-- sponsors --> block in
  README.md (current single sponsor cashbankss should remain — they are the
  only known sponsor of MSK-Scripts)

If the GraphQL call still fails after this PR, the new ::error:: annotations
will pinpoint whether it's the token scope (read:user/read:org) or
something else.

🤖 Generated with Claude Code