ci: fix 401 resolving MrCrayfish GitHub Packages deps

[KP2048]

Summary

CI's `check` job was failing at dependency resolution (before any test ran) with:
```
Could not GET '.../catalogue-common-1.21.1-1.11.0.pom'. Received status code 401 from server: Unauthorized
```
`build.gradle.kts`'s MrCrayfish GitHub Packages Maven repo block reads `GITHUB_ACTOR`/`GITHUB_TOKEN` via `"github_actor"/"github_token".localOrEnv`, but neither was ever passed into the `Run check` step's shell environment - so the request went out unauthenticated and GitHub Packages 401'd (it requires auth even for public package reads).

Added both as job-level `env:` so every step (including `Run check`) inherits them.

Heads up - this may not be fully sufficient on its own: `secrets.GITHUB_TOKEN` is scoped to this repo, and cross-owner GitHub Packages reads commonly need a real PAT (with `read:packages`) that's been granted access to MrCrayfish's packages specifically. If CI still 401s after this merges, that's the next thing to check - likely needs a dedicated PAT stored as a repo secret and swapped in for `GITHUB_TOKEN` in this same env block.

Test plan

• YAML validated (`python3 -c "import yaml; yaml.safe_load(...)"`)
• Confirm the next CI run on this PR gets past dependency resolution (watch for the same 401 vs. a new failure mode)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the GitHub Actions check workflow to export GITHUB_ACTOR/GITHUB_TOKEN into the job environment so Gradle can authenticate to MrCrayfish’s GitHub Packages Maven repo during dependency resolution, avoiding CI failures caused by 401 Unauthorized responses.

Changes:

• Add job-level env exports for GITHUB_ACTOR and GITHUB_TOKEN so ./gradlew check runs with the credentials build.gradle.kts expects.
• Document the rationale and known limitations (may still require a PAT with read:packages for cross-owner package access).

Suppressed comments (1)

.github/workflows/check.yaml:43

• Setting GITHUB_TOKEN at the job level exports it to every step and 3rd‑party action in this workflow, which increases blast radius if any step/action is compromised. Prefer scoping the token to only the Gradle invocation that needs GitHub Packages auth (e.g., env: on the “Run check” step).

      GITHUB_ACTOR: ${{ github.actor }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.