Update scripts to read tokens more securely

[henrymercer]

Also allow specifying tokens using an environment variable. This improves security.

[Copilot]

Pull request overview

This PR improves credential handling for repository maintenance scripts by avoiding passing GitHub tokens via command-line arguments, and instead supporting token retrieval from stdin and environment variables.

Changes:

• pr-checks/sync-checks.ts now resolves tokens via --token-stdin or GH_TOKEN/GITHUB_TOKEN (with unit tests for the resolution logic).
• update-release-branch.py now reads tokens from GH_TOKEN/GITHUB_TOKEN, and the update-release-branch workflow exports GITHUB_TOKEN into the script environment.
• Contributor documentation for regenerating required checks is updated to reflect the new token passing approach.

Show a summary per file

File	Description
pr-checks/sync-checks.ts	Add token resolution via stdin/env and update CLI parsing to use --token-stdin.
pr-checks/sync-checks.test.ts	Add unit tests covering stdin/env token resolution and failure cases.
CONTRIBUTING.md	Update instructions to use --token-stdin and/or GH_TOKEN/GITHUB_TOKEN.
.github/workflows/update-release-branch.yml	Export GITHUB_TOKEN so update-release-branch.py can authenticate via env var.
.github/update-release-branch.py	Switch authentication to read token from environment variables (removing CLI token usage).

Copilot's findings

Comments suppressed due to low confidence (1)

pr-checks/sync-checks.ts:305

• options here is the raw parseArgs().values object (with a "token-stdin" property) but is then passed around as Options. This works today because tokenStdin is optional and unused elsewhere, but it’s easy to accidentally start reading options.tokenStdin later and get undefined. Consider constructing a properly shaped Options object (including tokenStdin: options["token-stdin"]) and passing that through the rest of the script.

  // Find the check runs for the specified `ref` that we will later set as the required checks
  // for the main and release branches.
  const checkInfos = await getChecksFor(options, client, options.ref);
  const checkNames = new Set(checkInfos.map((info) => info.context));

• Files reviewed: 5/5 changed files
• Comments generated: 2