Use built-in Copilot auth for docs-actions callers (#6927)

## Summary
- remove `COPILOT_GITHUB_TOKEN` handoff from the `docs-actions` caller
workflows in `docs-content`
- add `copilot-requests: write` where the reusable workflow jobs now
depend on built-in Copilot auth
- align the PR and issue menu workflows with the updated reusable
workflow permission model

Closes elastic/docs-actions#188.

## Test plan
- [x] Verify the updated workflow callers no longer reference
`COPILOT_GITHUB_TOKEN`
- [x] Verify the reusable workflow jobs in the menu workflows request
`copilot-requests: write`
- [ ] Exercise one caller workflow against the updated `docs-actions`
branch

Co-authored-by: GPT-5.4 <gpt-5.4@openai.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

.github/workflows/docs-ai-menu.yml

@@ -14,6 +14,7 @@ on:
 
 permissions:
   contents: read
+  copilot-requests: write
   issues: write
 
 jobs:
@@ -152,6 +153,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
@@ -174,8 +176,6 @@ jobs:
         **Shared ownership**: Some paths have shared ownership (e.g., `/explore-analyze/machine-learning/` is shared by Developer and Experience). Pick the team whose keywords best match the issue content.
         **Internal projects**: If the issue seems related to an internal documentation project, initiative, or content strategy effort, apply `Team:Projects`.
         **Fallback**: If you genuinely cannot determine the owning team, apply `cross-team` so the issue stays visible to all teams.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   run-docs-issue-scope:
     name: Docs AI / issue scope
@@ -184,12 +184,11 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
     uses: elastic/docs-actions/.github/workflows/gh-aw-docs-issue-scope.lock.yml@v1
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   refresh-menu-after-docs-triage:
     name: Refresh AI menu after docs triage

.github/workflows/docs-applies-to-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-coherence-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-frontmatter-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-issue-scope.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -17,5 +18,3 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.comment.body, '/docs-issue-scope')
     uses: elastic/docs-actions/.github/workflows/gh-aw-docs-issue-scope.lock.yml@v1
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-openings-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-pr-ai-menu.yml

@@ -15,6 +15,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   checks: read
   contents: read
   discussions: write
@@ -190,6 +191,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      copilot-requests: write
       discussions: write
       issues: write
       pull-requests: write
@@ -199,8 +201,6 @@ jobs:
       additional-instructions: |
         This repository stores documentation as markdown across the repository, not only under `docs/`.
         Prefer concise, high-signal review comments with exact replacement text when possible.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
 
   refresh-menu-after-docs-review:
     name: Refresh AI PR menu after docs review

.github/workflows/docs-staleness-sweep.yml

@@ -33,6 +33,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -49,5 +50,3 @@ jobs:
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
       stale-content-months: ${{ inputs.stale-content-months }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-style-sweep.yml

@@ -29,6 +29,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -44,5 +45,3 @@ jobs:
       scope-mode: ${{ inputs.scope-mode }}
       target-batch-size: ${{ inputs.target-batch-size }}
       max-per-fix-issue: ${{ inputs.max-per-fix-issue }}
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-triage.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   actions: read
+  copilot-requests: write
   contents: read
   discussions: write
   issues: write
@@ -35,5 +36,3 @@ jobs:
         **Shared ownership**: Some paths have shared ownership (e.g., `/explore-analyze/machine-learning/` is shared by Developer and Experience). Pick the team whose keywords best match the issue content.
         **Internal projects**: If the issue seems related to an internal documentation project, initiative, or content strategy effort, apply `Team:Projects`.
         **Fallback**: If you genuinely cannot determine the owning team, apply `cross-team` so the issue stays visible to all teams.
-    secrets:
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}