ci(upstream-merge): ensure push auth by setting origin to x-access-token URL (uses CODE_GH_PAT || GITHUB_TOKEN) so Code agent can push branch

.github/workflows/upstream-merge.yml

@@ -42,6 +42,14 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Configure authenticated origin for pushes
+        env:
+          GH_TOKEN: ${{ secrets.CODE_GH_PAT || github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"
+
       - name: Setup Rust toolchain (match repo)
         uses: dtolnay/rust-toolchain@master
         with: