fix: use LOCALPIBOX_PAT secret for cross-repo tag creation [skip-version]

- GITHUB_TOKEN is scoped to devstack only, cannot create tags on other repos
- Add --header "Authorization: token $LOCALPIBOX_PAT" to gh api calls

Author: localpibox

.github/workflows/build-and-publish.yml

@@ -154,17 +154,17 @@ jobs:
             echo "Tagging $repo@$VERSION (from $branch)"
             sha=$(git ls-remote "https://github.com/$repo.git" "refs/heads/$branch" | awk '{print $1}')
             if [ -n "$sha" ]; then
-              # Create lightweight tags: POST to /git/refs/{ref} with sha body
-              # Handle 422 (already exists) gracefully by checking if tag exists
+              # Create lightweight tag using PAT (GITHUB_TOKEN is scoped to devstack only)
               if gh api "repos/$repo/git/refs/refs/tags/$VERSION" \
                   --method POST \
                   -f sha="$sha" \
+                  --header "Authorization: token $LOCALPIBOX_PAT" \
                   2>/dev/null; then
                 echo "  ✅ $repo@$VERSION"
-              elif gh api "repos/$repo/git/ref/tags/$VERSION" 2>/dev/null > /dev/null; then
+              elif gh api "repos/$repo/git/ref/tags/$VERSION" --header "Authorization: token $LOCALPIBOX_PAT" 2>/dev/null > /dev/null; then
                 echo "  ✅ $repo@$VERSION (already exists)"
               else
-                echo "  ⚠️  $repo tag creation failed (tag doesn't exist)"
+                echo "  ⚠️  $repo tag creation failed"
               fi
             else
               echo "  ⚠️  $repo:$branch not found, skipping tag"