Fix: Pass github-token to project safe-output handlers via GH_AW_PROJECT_GITHUB_TOKEN env var

[Copilot]

Project-related safe outputs (update-project, create-project-status-update, create-project) were failing with unhelpful errors when the handler manager couldn't read process.env.GH_AW_PROJECT_GITHUB_TOKEN. The token was configured in frontmatter (github-token: ${{ secrets.SMOKE_PROJECT_GITHUB_TOKEN }}) and passed in the handler config JSON, but the environment variable wasn't being set by the compiler.

Changes

• Modified pkg/workflow/compiler_safe_outputs_steps.go: Set GH_AW_PROJECT_GITHUB_TOKEN env var in handler manager step when any project config is present
• Token precedence: per-config token → top-level token → ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
• Coverage: Handles update-project, create-project-status-update, and create-project configs

Before/After

# Before - handler fails with "GH_AW_PROJECT_GITHUB_TOKEN not set"
env:
  GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{...\"github-token\":\"${{ secrets.SMOKE_PROJECT_GITHUB_TOKEN }}\"...}"
  GH_AW_PROJECT_URL: "https://github.com/orgs/myorg/projects/1"

# After - handler can authenticate and surface actual access errors
env:
  GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{...\"github-token\":\"${{ secrets.SMOKE_PROJECT_GITHUB_TOKEN }}\"...}"
  GH_AW_PROJECT_URL: "https://github.com/orgs/myorg/projects/1"
  GH_AW_PROJECT_GITHUB_TOKEN: ${{ secrets.SMOKE_PROJECT_GITHUB_TOKEN }}

Real project access failures (insufficient permissions, project not found) are now properly surfaced instead of being masked by token configuration errors.

Original prompt

Check run: https://github.com/githubnext/gh-aw/actions/runs/21593208108/job/62218818703#step:6:63
Project in another org is not accessible. We have actions.secrets token SMOKE_PROJECT_GITHUB_TOKEN, so it should have access. Make sure if errors like this happen, they get surfaced.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.