fix(ci): wire GITHUB_TOKEN into the tox test job

test_real_download_on_cache_miss makes a real, unauthenticated
api.github.com call to resolve tflint's latest-releases listing.
GITHUB_TOKEN was never actually forwarded into the pytest job's
environment - tox.ini's 'pass_env = GITHUB_*' can only pick up a
variable that's already there, and reusable-tox.yml never set it.

With a 5-python x 4-OS matrix (20 jobs) all potentially sharing
GitHub-hosted runners' pooled egress IPs, unauthenticated requests
(60/hr per IP, shared with unrelated concurrent traffic) are a
well-known source of exactly this kind of intermittent, job-specific
failure - matches what was observed: a fast (~0.3s) failure on one
matrix cell (pytest-3.12) while the rest of the matrix passed.

This wires in the same GITHUB_TOKEN auto-authentication the project
already documents as supported for version resolution (README.md,
'Most hooks: Pin a specific tool version') and already uses for
Docker image builds - it was simply never connected for this job.

Assisted-by: Sisyphus:claude-sonnet-5 claude

Author: MaxymVlasov

.github/workflows/reusable-tox.yml

@@ -311,6 +311,13 @@ jobs:
       id: tox-run
       shell: bash
       env:
+        # Consumed by tools/install/_common.sh (via `pass_env = GITHUB_*`
+        # in tox.ini) to authenticate GitHub API calls made while
+        # resolving `--tool-version` pins - without it, requests are
+        # unauthenticated and share GitHub's low per-IP rate limit
+        # across every job in this workflow's matrix, which is exactly
+        # what test_real_download_on_cache_miss can hit.
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         INPUT_TOX_RUN_POSARGS: ${{ inputs.tox-run-posargs }}
       run: |-
         tox_common_args=(