Fix: pass token for private repo isolation checks

[ModeSevenIndustrialSolutions]

Important

Draft — blocked on lfit/releng-reusable-workflows#813.
Passing a secret that the referenced reusable workflow does not declare is a workflow validation error, so this must not merge first. The pin also still needs bumping (see below).

Problem

Every failed run of Gerrit Required Change Isolation Verify has the same cause — the target repository is private. Example: run #17 against TARGET_REPO: lfit/lfcore-terraform.

repository 'https://github.com/lfit/lfcore-terraform/' not found      (x3 retries)
The process '/usr/bin/git' failed with exit code 128
base-ref 'HEAD~1' could not be resolved to a commit. ...
Process completed with exit code 1

The change-isolation-verify job passes no token to the reusable workflow, so its Gerrit checkout falls back to this repository's GITHUB_TOKEN. That token is scoped to lfit/.github alone and returns 404 for any private mirror, so the job fails and votes -1 on a change that is perfectly fine.

This is not specific to one repository — 11 of 63 lfit repositories are private, including precisely the puppet-* / lfcore-* / ci-management trees:

lfit/ci-management                 lfit/lfcore-tools-misc
lfit/internal-reusable-workflows   lfit/puppet-hiera
lfit/lf-gpg-verify-action          lfit/puppet-master
lfit/lfcore-ansible-playbooks      lfit/puppet-modules-local_fw
lfit/lfcore-terraform              lfit/puppet-modules-profile
                                   lfit/puppet-modules-role

gerrit-required-verify.yaml in this same repository already checks out that exact set successfully, using token: ${{ secrets.REPLICATION_TOKEN }}. The credential exists and is proven; the isolation workflow just never plumbed it through.

Change

    secrets:
      token: ${{ secrets.REPLICATION_TOKEN }}

Passed explicitly rather than via secrets: inherit, to keep the reusable workflow's access limited to the one credential it needs.

Why not just exclude lfcore-terraform?

It was considered and rejected:

1. It is a token-scope problem, not a repo-specific one — the next private repo to receive a change fails identically, so exclusion is whack-a-mole across eleven repositories.
2. These are the infrastructure repositories where INFO.yaml and .github isolation matters most, and they are already explicitly in scope for the sibling GPG-validation required workflow.
3. There is nowhere clean to put an exclusion. This workflow is workflow_dispatch-only, fired by the lfit-replication service account from Gerrit (event=workflow_dispatch, actor=lfit-replication); it is not a ruleset, so exclusion would mean either a guard job here or a change to the Gerrit-side dispatcher.

Before merging

Bump the reusable workflow pin from 5278f76 (v0.8.1) to the release containing lfit/releng-reusable-workflows#813. I will update this PR once that lands.

Validation

• zizmor --persona auditor: no findings
• prek hooks pass; commit is GPG-signed with a DCO sign-off

Companion PR (the actual fix, plus a second defect where if: !cancelled() masked the real checkout failure behind a misleading HEAD~1 error): lfit/releng-reusable-workflows#813

[ModeSevenIndustrialSolutions]

Closing: the change isolation workflow is being removed from this repository, so there is no caller left to pass the token through to.

The underlying fixes remain relevant and stay open in lfit/releng-reusable-workflows#813 — in particular the if: !cancelled() gating defect, which is independent of the token plumbing and affects any consumer of these reusable workflows.