fix(ci): authenticate CML release lookup

[TimeToBuildBob]

Problem

The screenshot-comment workflow intermittently fails before downloading artifacts because iterative/setup-cml@v3 queries the public CML release API without authentication. The failed runs report an API rate-limit error for the shared runner IP, including run 29195897537 and run 34566780864.

Fix

Pass the workflow's GITHUB_TOKEN to setup-cml. The action already reads this environment variable when constructing Octokit, so release lookup gets the authenticated GitHub API quota.

Verification

• Workflow YAML parses successfully.
• The setup-cml step retains vega: false and now has the token environment variable.
• git diff --check passes.

The original run is stale, so I did not rerun it; the next successful Build workflow will exercise this workflow_run path naturally.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previous token-exposure concern was addressed by pinning the CML action and its thread was manually resolved.

Summary

• Supplies GITHUB_TOKEN to iterative/setup-cml.
• Preserves vega: false.
• Replaces the mutable CML v3 tag with its full commit SHA.

_{Reviews (2) · Last reviewed commit: "fix(ci): pin token-consuming CML action"}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.11%. Comparing base (2ddc69f) to head (025195b).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #981   +/-   ##
=======================================
  Coverage   53.11%   53.11%           
=======================================
  Files          48       48           
  Lines        2984     2984           
  Branches      681      681           
=======================================
  Hits         1585     1585           
  Misses       1379     1379           
  Partials       20       20           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[TimeToBuildBob]

CI-green and mergeable — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.

[TimeToBuildBob]

🤖 AI code review

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No findings. The diff looks correct to me on this pass.

_{Reviewed 025195b9325e · openrouter/deepseek/deepseek-v4-flash-0731 · llm (in-band) engine · 3s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[TimeToBuildBob]

@greptileai review