fix(ci): authenticate uvr's GitHub resolution in the index workflows (#204)

## Why

The post-backfill re-index (12257) reported failure. Five slots could not write their indexes:

```
WARN Failed to fetch git Remote pat-s/cranlike@s3 (GitHub API error: 403 Forbidden);
     falling back to registry resolution
! Attempt 1/3 to update PACKAGES failed (unused argument (built = built)). Retrying in 5s...
Error: Failed to update PACKAGES after 3 attempts.
       Last error: unused argument (built = built)
```

uvr resolves bincraft's dependencies through the GitHub API, including the `pat-s/cranlike@s3` fork. Unauthenticated, that is rate limited. uvr does not fail on the 403 — it **warns and falls back to the registry copy of cranlike**, which has no `built` parameter, so `update_PACKAGES(built = ...)` dies three retries later.

Affected: alpine323, rhel8, rhel9, rhel10, noble. The remaining 13 slots resolved the fork fine and indexed correctly, which is what makes this insidious: the same pipeline passes or fails on identical input depending on the rate-limit window.

`build-all-versions.yaml` and `rebuild-abi-gap.yaml` already pass `GITHUB_PAT`, which is why they were never affected.

## What changed

Adds the `GITHUB_PAT` secret to `reindex.yaml`, `weekly-rebuild-reindex.yaml` and `backfill-flat-safety.yaml`, with a comment recording why its absence is quiet rather than loud.

`crow lint` passes on all three.

## Context

The re-index itself did what it was meant to. Drops per per-minor index fell from ~1800-2200 to:

```
4.4: avg 129    4.5: avg 172    4.6: avg 145
```

so the per-object safety verdicts recovered roughly 93% of the coverage while still dropping every object that genuinely cannot load. This PR is about the five slots that never got to apply it.

Reviewed-on: #204

.crow/backfill-flat-safety.yaml

@@ -150,6 +150,14 @@ steps:
         from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
+      # uvr resolves bincraft's dependencies through the GitHub API, including
+      # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the
+      # failure is not loud: uvr warns, falls back to the registry copy of
+      # cranlike, and the index write then dies on `unused argument (built =
+      # built)` because upstream has no such parameter. Intermittent by nature,
+      # since it depends on the rate-limit window.
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
       GIT_USER: pat-s
       R_LIBS_USER: /tmp/R-pkgs
       FLAT_SAFETY_ARCH: ${ARCH}

.crow/reindex.yaml

@@ -151,6 +151,14 @@ steps:
         from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
+      # uvr resolves bincraft's dependencies through the GitHub API, including
+      # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the
+      # failure is not loud: uvr warns, falls back to the registry copy of
+      # cranlike, and the index write then dies on `unused argument (built =
+      # built)` because upstream has no such parameter. Intermittent by nature,
+      # since it depends on the rate-limit window.
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
       GIT_USER: pat-s
       R_LIBS_USER: /mnt/cache/R-pkgs
       R_VERSION: ${R_VERSION}

.crow/weekly-rebuild-reindex.yaml

@@ -154,6 +154,14 @@ steps:
         from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
+      # uvr resolves bincraft's dependencies through the GitHub API, including
+      # the pat-s/cranlike@s3 fork. Unauthenticated it is rate limited, and the
+      # failure is not loud: uvr warns, falls back to the registry copy of
+      # cranlike, and the index write then dies on `unused argument (built =
+      # built)` because upstream has no such parameter. Intermittent by nature,
+      # since it depends on the rate-limit window.
+      GITHUB_PAT:
+        from_secret: GITHUB_PAT
       GIT_USER: pat-s
       R_LIBS_USER: /mnt/cache/R-pkgs
       R_VERSION: ${R_VERSION}