fix(ci): authenticate uvr's GitHub resolution in the index workflows

uvr resolves bincraft's dependencies through the GitHub API, among them the
pat-s/cranlike@s3 fork. Unauthenticated that is rate limited, and the failure is
quiet:

  WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden);
       falling back to registry resolution
  Error: Failed to update PACKAGES after 3 attempts.
         Last error: unused argument (built = built)

uvr warns, falls back to the registry copy of cranlike, and the index write then
dies because upstream cranlike has no `built` parameter. Five slots failed to
re-index that way -- alpine323, rhel8, rhel9, rhel10 and noble -- while the rest
of the run reported success.

It is intermittent by nature, since it depends on the rate-limit window, so the
same pipeline can pass and fail on identical input.

build-all-versions.yaml and rebuild-abi-gap.yaml already pass GITHUB_PAT, which
is why they resolve the fork reliably and these did not.

.crow/backfill-flat-safety.yaml

@@ -150,6 +150,14 @@ steps:
         from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
+      # uvr resolves bincraft's dependencies through the GitHub API, including
+      # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the
+      # failure is not loud: uvr warns, falls back to the registry copy of
+      # cranlike, and the index write then dies on `unused argument (built =
+      # built)` because upstream has no such parameter. Intermittent by nature,
+      # since it depends on the rate-limit window.
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
       GIT_USER: pat-s
       R_LIBS_USER: /tmp/R-pkgs
       FLAT_SAFETY_ARCH: ${ARCH}