[ci] Fix BOT_TOKEN auth for Flex endpoint push and PR diff comment

The previous attempt still failed:

- The Flex push embedded the token in the URL, but actions/checkout had
  persisted an http.<host>.extraheader Authorization for the default
  GITHUB_TOKEN, which git sends in preference to the URL credentials —
  so the push authenticated as github-actions[bot] and got 403. Unset
  that header before pushing so the BOT_TOKEN in the URL is used.

- marocchino/sticky-pull-request-comment reads the token from its
  GITHUB_TOKEN input (default github.token), not the env var, so the
  read-only default token was still used. Pass it via "with:" instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/callable-qa.yml

@@ -68,6 +68,7 @@ jobs:
                     mv .github/flex-endpoint/*.json .
                     git add *.json
                     git commit -m 'Create Flex endpoint' || true
+                    git config --local --unset-all http.https://github.com/.extraheader || true
                     git push -f "https://x-access-token:${{ secrets.token }}@github.com/${{ github.repository }}" "flex/pull-${{ github.event.number }}"
                     git switch pr
                     git stash pop -q
@@ -91,9 +92,8 @@ jobs:
                 name: Post diff between recipe versions
                 if: "always() && steps.checkout.outcome == 'success'"
                 uses: marocchino/sticky-pull-request-comment@v2
-                env:
-                    GITHUB_TOKEN: ${{ secrets.token }}
                 with:
+                    GITHUB_TOKEN: ${{ secrets.token }}
                     path: .github/diff-recipe-versions.md
 
             -