[svg153]

Closes #44.
Refs #35.

Summary

Aligns the existing trusted Waza workflow with the current Copilot SDK authentication contract. It removes the obsolete COPILOT_SDK_TOKEN assumption already corrected in svg153/skills#53.

Authentication paths

• prefer an explicitly configured COPILOT_GITHUB_TOKEN when present;
• otherwise, because this repository is organization-owned, use the built-in GITHUB_TOKEN with copilot-requests: write when the organization has enabled the required Copilot Actions billing/policy;
• do not commit any credential.

Evidence integrity

• a scheduled run without supported auth reports that model evidence was skipped;
• a manually requested run without supported auth fails rather than returning a misleading green result;
• artifacts upload only when a model-backed evaluation was actually attempted;
• the existing Waza suite, prompt, thresholds, and canonical skill remain unchanged.

Passing PR checks prove workflow/security/static correctness only. #35 counts behavioral evidence only after Waza/model steps execute and produce evidence.