fix(ci): require UPSTREAM_TOKEN PAT for fork sync push

GITHUB_TOKEN cannot push to fork repos in scheduled workflows.
Remove the GITHUB_TOKEN fallback so the workflow fails explicitly
when UPSTREAM_TOKEN is missing, instead of silently 403-ing.
Also add issues:write permission and git user config for merges.

.github/workflows/sync-upstream.yml

@@ -2,6 +2,7 @@ name: Upstream Sync
 
 permissions:
   contents: write
+  issues: write
 
 on:
   schedule:
@@ -19,7 +20,17 @@ jobs:
         with:
           ref: master
           fetch-depth: 0
-          token: ${{ secrets.UPSTREAM_TOKEN || secrets.GITHUB_TOKEN }}
+          # Must use a PAT with repo scope — GITHUB_TOKEN cannot push in fork scheduled workflows
+          token: ${{ secrets.UPSTREAM_TOKEN }}
+
+      - name: Check UPSTREAM_TOKEN
+        run: |
+          if [ -z "$UPSTREAM_TOKEN" ]; then
+            echo "::error::UPSTREAM_TOKEN secret is not set. Please add a Personal Access Token with repo scope to your repository secrets."
+            exit 1
+          fi
+        env:
+          UPSTREAM_TOKEN: ${{ secrets.UPSTREAM_TOKEN }}
 
       - name: Sync upstream changes
         id: sync
@@ -40,6 +51,10 @@ jobs:
           echo "Upstream: $UPSTREAM"
           echo "has_changes=true" >> "$GITHUB_OUTPUT"
 
+          # Configure git for the merge commit
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
           # Try merge first (preserves both histories)
           if git merge upstream/master --no-edit; then
             git push origin master