read git.hanzo.ai with the token it already issues

FORGE_TOKEN was a hand-provisioned PAT kept as an org-wide Actions secret. Hanzo
Git hands every job a token — checkout writes it into http.extraheader with no
secret involved — so this was a second credential home beside KMS that rotted on
its own schedule and bought nothing.

Now GIT_TOKEN, from github.token.

.hanzo/workflows/release.yml

@@ -217,12 +217,12 @@ jobs:
             -d '{"draft":false}' | jq -r '"published: " + .html_url'
       - name: Mirror the release to the forge
         env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
+          GIT_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          [ -n "${FORGE_TOKEN:-}" ] || { echo "no FORGE_TOKEN — skipping forge mirror"; exit 0; }
-          git push "https://x:$FORGE[email protected]/hanzoai/dev.git" "$GITHUB_SHA:refs/tags/v$V" || true
-          a() { curl -fsS -H "Authorization: token $FORGE_TOKEN" -H 'Accept: application/json' "$@"; }
+          [ -n "${GIT_TOKEN:-}" ] || { echo "no GIT_TOKEN — skipping forge mirror"; exit 0; }
+          git push "https://x:$GIT[email protected]/hanzoai/dev.git" "$GITHUB_SHA:refs/tags/v$V" || true
+          a() { curl -fsS -H "Authorization: token $GIT_TOKEN" -H 'Accept: application/json' "$@"; }
           rel=$(a "https://git.hanzo.ai/v1/repos/hanzoai/dev/releases/tags/v$V" 2>/dev/null | jq -r '.id // empty' || true)
           [ -n "$rel" ] || rel=$(a -X POST "https://git.hanzo.ai/v1/repos/hanzoai/dev/releases" -H 'Content-Type: application/json' \
             -d "$(jq -nc --arg t "v$V" --arg n "Release v$V" '{tag_name:$t,name:$n}')" | jq -r .id)
@@ -277,7 +277,7 @@ jobs:
           git -c user.name=hanzo-dev -c [email protected] commit -qam "hanzo-dev $V" && git push -q || echo "formula unchanged"
       - name: Bump
         env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
+          GIT_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           git add codex-cli/package.json codex-cli/package-lock.json Formula/hanzo-dev.rb 2>/dev/null || true
@@ -285,4 +285,4 @@ jobs:
           push() { git push "$1" HEAD:main && return
             git fetch "$1" main && git -c user.name=hanzo-dev -c [email protected] rebase FETCH_HEAD && git push "$1" HEAD:main; }
           push "https://x-access-token:[email protected]/hanzoai/dev.git"
-          [ -z "${FORGE_TOKEN:-}" ] || push "https://x:$FORGE[email protected]/hanzoai/dev.git" || true
+          [ -z "${GIT_TOKEN:-}" ] || push "https://x:$GIT[email protected]/hanzoai/dev.git" || true