fix: use GITHUB_TOKEN instead of GITHUB_MIRROR_TOKEN for push mirrors

Single PAT with repo scope handles both migration and push mirroring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase6_github_mirrors.sh

@@ -18,7 +18,7 @@ source "${SCRIPT_DIR}/lib/common.sh"
 
 load_env
 require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
-             GITHUB_USERNAME GITHUB_TOKEN GITHUB_MIRROR_TOKEN GITHUB_MIRROR_INTERVAL \
+             GITHUB_USERNAME GITHUB_TOKEN GITHUB_MIRROR_INTERVAL \
              REPO_1_NAME REPO_2_NAME REPO_3_NAME
 
 phase_header 6 "GitHub Push Mirrors"
@@ -48,14 +48,13 @@ for repo in "${REPOS[@]}"; do
   # -------------------------------------------------------------------------
   # Step B: Create push mirror
   # Configures Gitea to push all refs to GitHub on every commit and on a
-  # schedule. Uses a dedicated GitHub PAT (GITHUB_MIRROR_TOKEN) which needs
-  # repo write scope.
+  # schedule. Uses GITHUB_TOKEN which needs repo scope (read+write).
   # -------------------------------------------------------------------------
   log_step "B" "Creating push mirror for ${repo}..."
   MIRROR_PAYLOAD=$(jq -n \
     --arg remote_address "https://github.com/${GITHUB_USERNAME}/${repo}.git" \
     --arg remote_username "$GITHUB_USERNAME" \
-    --arg remote_password "$GITHUB_MIRROR_TOKEN" \
+    --arg remote_password "$GITHUB_TOKEN" \
     --arg interval "$GITHUB_MIRROR_INTERVAL" \
     '{
       remote_address: $remote_address,