fix: leave GITHUB_TOKEN unset when the secret is absent

Review feedback from vladfrangu on #309.

`GITHUB_TOKEN="$(cat ... 2>/dev/null || true)"` always set the variable,
exporting an empty string to `camoufox fetch` when no secret was mounted.
Both consumers treat "" as absent today (camoufox-js 0.12.0
`pkgman.js:24`, camoufox 0.5.6 `pkgman.py:467` both test truthiness), so
nothing was broken, but the behaviour depended on that check.

Read the secret only when it is readable, so an absent or unreadable
file leaves the variable unset. `-r` rather than `-e` also covers the
non-root node stage losing `mode=0444`, which previously degraded to an
empty token instead of no token.

Assignment and export are split to keep shellcheck SC2155 quiet.

Also trims the comment blocks in both Dockerfiles.

Verified in buildkit on a non-root stage: no secret -> unset; secret
mounted -> token present; `mode=0444` removed -> unset, not empty.
hadolint matches baseline on both files, zero new findings.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: l2ysho

node-playwright-camoufox/Dockerfile

@@ -136,16 +136,17 @@ RUN if [ "$SLIM" = "1" ]; then mv package.slim.json package.json; else rm packag
 
 # Install default dependencies, print versions of everything
 #
-# `camoufox-js fetch` reads api.github.com, where the whole matrix shares one 60/hour budget.
-# GITHUB_TOKEN lifts it to 1000/hour; a secret, not a build arg, keeps it out of the layers.
-# mode=0444 because this stage runs as myuser and secrets default to root-owned 0400.
-# Without it the build stays unauthenticated and still works.
+# GITHUB_TOKEN raises the api.github.com rate limit for `camoufox-js fetch`. A secret, not a build
+# arg, keeps it out of the layers; mode=0444 because this stage runs as myuser. Optional.
 RUN --mount=type=secret,id=github_token,mode=0444 \
     npm --quiet set progress=false \
     \
     # Install Camoufox browser
-    && GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" \
-    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 npx camoufox-js fetch \
+    && if [ -r /run/secrets/github_token ]; then \
+           GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+           export GITHUB_TOKEN; \
+       fi \
+    && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 npx camoufox-js fetch \
     # Overrides the dynamic library used by Firefox to determine trusted root certificates with p11-kit-trust.so, which loads the system certificates.
     && rm -f /home/myuser/.cache/camoufox/libnssckbi.so \
     && ln -s $(ls -d /usr/lib/*-linux-gnu)/pkcs11/p11-kit-trust.so /home/myuser/.cache/camoufox/libnssckbi.so \

python-playwright-camoufox/Dockerfile

@@ -104,9 +104,8 @@ ENV PATH="/root/.local/bin:/home/myuser/.local/bin:$PATH"
 # - Installs the specified version of Playwright and Camoufox
 # - Fetches the Camoufox browser
 #
-# `camoufox fetch` reads api.github.com, where the whole matrix shares one 60/hour budget.
-# GITHUB_TOKEN lifts it to 1000/hour; a secret, not a build arg, keeps it out of the layers.
-# Without it the build stays unauthenticated and still works.
+# GITHUB_TOKEN raises the api.github.com rate limit for `camoufox fetch`. A secret, not a build
+# arg, keeps it out of the layers. Optional.
 RUN --mount=type=secret,id=github_token \
     python -m pip install --upgrade \
     pip \
@@ -115,8 +114,11 @@ RUN --mount=type=secret,id=github_token \
     playwright~=${PLAYWRIGHT_VERSION} \
     camoufox[geoip]~=${CAMOUFOX_VERSION} \
     # Fetch the Camoufox browser
-    && GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" \
-    python -m camoufox fetch \
+    && if [ -r /run/secrets/github_token ]; then \
+           GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+           export GITHUB_TOKEN; \
+       fi \
+    && python -m camoufox fetch \
     # `camoufox fetch` swallows sync errors and exits 0, so check what the runtime checks
     # rather than ship an image that only fails at launch.
     && python -c "from camoufox.pkgman import installed_verstr; print('Camoufox installed:', installed_verstr())" \