CI: use the built-in GITHUB_TOKEN instead of a long-lived PAT

The GH_TOKEN secret expired, breaking both workflows: ghcr.io login
failed with "denied: denied" and the Helm chart push failed with
"Authentication failed".

Both jobs only act on this repository, so the ephemeral GITHUB_TOKEN
covers them. publish.yml already declares packages: write and
publish-helm.yml already declares contents: write. Nothing left to
rotate, and no broadly-scoped PAT sitting in Actions secrets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JDk5guu51FjFxQMjgrrekW

.github/workflows/publish-helm.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Publish to gh-pages
         uses: peaceiris/actions-gh-pages@v4
         with:
-          github_token: ${{ secrets.GH_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: chart-output
           destination_dir: docs
           keep_files: true

.github/workflows/publish.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GH_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push backend image
         uses: docker/build-push-action@v5