fix(add_comment): remove expired AWI_MAINTENANCE_TOKEN, add 401 fallback to step-level token

[Copilot]

add_comment in PR Sous Chef was failing 401 Bad Credentials on every run while update_pull_request and dismiss_pull_request_review succeeded against the same PR in the same job — because add_comment was the only handler configured with an explicit github-token: ${{ secrets.AWI_MAINTENANCE_TOKEN }} (expired/revoked), while the other handlers fell through to the step-level token.

Changes

Root cause fix — pr-sous-chef.md + pr-sous-chef.lock.yml

• Removed github-token: ${{ secrets.AWI_MAINTENANCE_TOKEN }} from the add-comment: handler config. No other handler needed this override; the step-level GH_AW_GITHUB_TOKEN || GITHUB_TOKEN is sufficient and already works for all other safe-output types in this workflow.

Resilience — add_comment.cjs

• Captures the step-level global.github client at factory init as stepLevelGithub, tracks whether a per-handler token is in use (usingPerHandlerToken).
• On error.status === 401 with a per-handler token active, retries comment creation (both issue/PR and discussion paths) using stepLevelGithub instead of propagating the failure.

// Capture step-level client before per-handler client may override it
// @ts-ignore - global.github is set by setupGlobals() from github-script context
const stepLevelGithub = global.github;
const githubClient = await createAuthenticatedGitHubClient(config);
const usingPerHandlerToken = githubClient !== stepLevelGithub;

// ... in catch:
if (error?.status === 401 && usingPerHandlerToken) {
  // retry with stepLevelGithub ...
}

Regression tests — add_comment.test.cjs

Four new tests in "401 Bad Credentials fallback (per-handler token)":

• Fallback succeeds when per-handler token returns 401
• Both tokens returning 401 propagates failure
• No fallback triggered when no per-handler token is configured
• Mixed-batch: update_pull_request succeeds then add_comment falls back and succeeds

• Fixes [aw-failures] [aw-fix] P1: PR Sous Chef — add_comment returns 401 Bad Credentials on PR #48593, failing Process Safe Outputs #48714