fix: give the specification fetch the token gh demands inside Actions

`fetch_measurement_inputs.py` reads the pinned Stripe documents through the `gh` CLI,
because both are larger than the 1 MB ceiling GitHub puts on the base64 `.content`
field and only the raw endpoint returns them whole. Inside a workflow `gh` refuses to
run at all without `GH_TOKEN`, public repository or not, so the step this landed with
failed on its first run with `To use GitHub CLI in a GitHub Actions workflow, set the
GH_TOKEN environment variable`.

The workflow's own token covers it: the read is `stripe/openapi` at a pinned tag and
the job holds read permissions only. Scoped to the one step rather than the job, so
nothing else acquires a credential it has no use for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: stroland02

.github/workflows/ci.yml

@@ -142,6 +142,11 @@ jobs:
       # Both scripts verify what they write before writing it: a git blob hash per specification,
       # and the pinned digest for the map. Neither can quietly substitute an input.
       - name: Stage the pinned Stripe specifications
+        # `gh_raw` shells out to the `gh` CLI, which refuses to run inside Actions without
+        # `GH_TOKEN` even against a public repository. The workflow's own token is enough:
+        # this reads `stripe/openapi` at a pinned tag, and the job's permissions are read-only.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: uv run python scripts/fetch_measurement_inputs.py
 
       - name: Stage the pinned symbol map