fix: extra-empty-commit trigger push authenticates as CI-trigger token, not GITHUB_TOKEN

[Copilot]

GH_AW_CI_TRIGGER_TOKEN / github-token-for-extra-empty-commit was silently ignored. The actions/checkout persist-credentials: true default writes http.<serverUrl>/.extraheader carrying GITHUB_TOKEN; git applies that header to every matching request, taking precedence over any token embedded in the remote URL. The empty commit was pushed as github-actions[bot], so no CI runs were triggered.

Changes

• actions/setup/js/git_auth_helpers.cjs (new): shared helpers for http.<serverUrl>/.extraheader management — getPersistedExtraheader, checkoutHasPersistedExtraheader (moved from dynamic_checkout.cjs), overridePersistedExtraheader (--replace-all to collapse to a single Authorization header), restorePersistedExtraheader

• actions/setup/js/extra_empty_commit.cjs: before the push, override the extraheader with the CI-trigger token; use a credential-free remote URL; restore the original extraheader in a finally block so the token doesn't leak into subsequent steps:

  prevExtraheader = await getPersistedExtraheader(githubServerUrl);
  await overridePersistedExtraheader(githubServerUrl, token); // git config --replace-all
  // ... credential-free remote URL, fetch, commit, push ...
  // finally: restorePersistedExtraheader(githubServerUrl, prevExtraheader)

• actions/setup/js/dynamic_checkout.cjs: import checkoutHasPersistedExtraheader from the shared module

• actions/setup/js/extra_empty_commit.test.cjs / extra_empty_commit.integration.test.cjs: add getExecOutput mock, new tests asserting the --replace-all override fires before push with correct base64 token, and the extraheader is restored/unset after push

• docs/src/content/docs/reference/triggering-ci.mdx: clarify the trigger works regardless of persist-credentials state; add troubleshooting note (verify actor is the PAT/App identity, not github-actions[bot])