Speed up GHA workflows, use consistent bot token, etc

[jakebailey]

An amalgamation of various fixups and improvements:

• Use the bot's token everywhere rather than contents: write. When using contents: write, GHA workflows won't run when pushed as GHA tries to prevent loops by poisoning the token. A PAT works around this.
• Don't run tests in sync-branch. This is slightly risky given baselines might fail, but I don't think we've seen that happen and @DanielRosenwasser reports that this delay is annoying.
• Update package-lock.json when changing package.json's version. This is harmless but generally annoying that package-lock is not up to date on release branches. Honestly, I'm shocked that npm ci is okay with that state.
• Remove update-lkg.yml, which could only ever update LKG on main, which I removed a while back.
• Use a "blobless" clone rather than a full clone when we need history; this mode downloads the commit info, but none of the file contents until they are actually needed. This brings a full clone of our repo in CI down from 4m to 1m30m or so. See: https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ Add support for partial checkout filters actions/checkout#1396 (comment)

[DanielRosenwasser]

What's the point of the LKG? Just as a test to see that it works?

[jakebailey]

E.g. the LKG script silently broke because a dep updated, or something. Otherwise we wouldn't know until we attempted to do a release or nightly or something.

[jakebailey]

(this particular change is just to make all of the workflows have the same casing; silly, I know)

[DanielRosenwasser]

do we want this to be v4 also?

[jakebailey]

Surprisingly, this doesn't do a full fetch, so I don't need to bump it to get the new filter options.

I wanted to bump all of the versions but I'd need to update every file's version specifiers which felt noisy. Probably, we should enable dependabot but just for GHA. But either of those I'd rather in a different PR.

[DanielRosenwasser]

Thanks for sending this! I don't know the nuances of permissions.contents: "write" so I can't sign off right away, but doing the blobless clone is a great idea for these.

[jakebailey]

Thanks for sending this! I don't know the nuances of permissions.contents: "write" so I can't sign off right away

This should be safe; we already use that in the package-lock workflow.

[jakebailey]

Any other concerns?