[ci] Use BOT_TOKEN for the Flex endpoint push and PR diff comment

The default GITHUB_TOKEN is now read-only, so pushing the generated Flex
endpoint and posting the recipe-diff comment failed (403 / "Resource not
accessible by integration"). Authenticate both via the BOT_TOKEN without
persisting it into the checkout credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/callable-qa.yml

@@ -68,7 +68,7 @@ jobs:
                     mv .github/flex-endpoint/*.json .
                     git add *.json
                     git commit -m 'Create Flex endpoint' || true
-                    git push origin -f flex/pull-${{ github.event.number }}
+                    git push -f "https://x-access-token:${{ secrets.token }}@github.com/${{ github.repository }}" "flex/pull-${{ github.event.number }}"
                     git switch pr
                     git stash pop -q
 
@@ -91,6 +91,8 @@ jobs:
                 name: Post diff between recipe versions
                 if: "always() && steps.checkout.outcome == 'success'"
                 uses: marocchino/sticky-pull-request-comment@v2
+                env:
+                    GITHUB_TOKEN: ${{ secrets.token }}
                 with:
                     path: .github/diff-recipe-versions.md