chore(ci): use personal access token for hash update (#1925)

## Description

Unfortunately the method of manually calling CI on the PR branch used by
#1907 doesn't count as status check of that PR (#1924), probably because
the called workflow inherits the context of the calling workflow, which
is not triggered by the PR. I read the docs and the most straightforward
solution is using a PAT, which does trigger the pull_request event.
Alternatively you can open PR with a custom github app, which is more
complicated but allows the app to bypass ruleset and commit directly to
main. Or just disable mandatory status checks.

## Linked Issues



## Additional Context

<!-- e.g. is there anything you'd like reviewers to focus on? -->

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Rin <shinohara-rin@users.noreply.github.com>

.github/workflows/ci.yml

@@ -10,20 +10,12 @@ on:
 
   workflow_dispatch:
 
-  workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
       - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v6
         with:
@@ -73,8 +65,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -124,8 +114,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -171,8 +159,6 @@ jobs:
     if: ${{ !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.label, 'moeru-ai:i18n/')) }}
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Node.js
       - uses: pnpm/action-setup@v5
@@ -190,7 +176,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.ref || github.ref }}
           fetch-depth: 0
       - uses: danielroe/provenance-action@main
         id: check

.github/workflows/update-nix-assets-hash.yaml

@@ -17,8 +17,6 @@ jobs:
   update:
     if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
-    outputs:
-      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -32,6 +30,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: main # Use main regardless of workflow_dispatch branch
+          # Authenticate git with PAT so that pushing to head retriggers CI
+          token: ${{ secrets.HASH_UPDATE_TOKEN }}
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -52,7 +52,8 @@ jobs:
       - name: Create PR
         if: steps.changes.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Create PR with PAT to trigger CI
+          GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -72,11 +73,3 @@ jobs:
 
           # Enable auto-merge so PR merges once checks pass
           gh pr merge --squash --auto --delete-branch chore/update-nix-assets-hash
-
-  # Call CI as reusable workflow because bot PR doesn't trigger CI
-  ci:
-    needs: update
-    if: needs.update.outputs.has_changes == 'true'
-    uses: ./.github/workflows/ci.yml
-    with:
-      ref: chore/update-nix-assets-hash

.github/workflows/update-nix-pnpm-deps-hash.yaml

@@ -16,8 +16,6 @@ jobs:
   update:
     if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
-    outputs:
-      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -31,6 +29,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: main # Use main regardless of workflow_dispatch branch
+          # Authenticate git with PAT so that pushing to head retriggers CI
+          token: ${{ secrets.HASH_UPDATE_TOKEN }}
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -51,7 +51,8 @@ jobs:
       - name: Create PR
         if: steps.changes.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Create PR with PAT to trigger CI
+          GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -71,11 +72,3 @@ jobs:
 
           # Enable auto-merge so PR merges once checks pass
           gh pr merge --squash --auto --delete-branch chore/update-nix-pnpm-deps-hash
-
-  # Call CI as reusable workflow because bot PR doesn't trigger CI
-  ci:
-    needs: update
-    if: needs.update.outputs.has_changes == 'true'
-    uses: ./.github/workflows/ci.yml
-    with:
-      ref: chore/update-nix-pnpm-deps-hash