Fix repo health GitHub CLI auth

[simongonzalezdc]

Summary

• Export GH_TOKEN for the Repo Health Monitor job so GitHub CLI commands can authenticate in Actions.
• Grant actions: read because the workflow reads recent run status with gh run list.
• Add a regression test that locks down the workflow auth contract.

Verification

• python3 -m pytest tests/test_repo_health_workflow.py -q
• python3 -m pytest tests/ -q
• git diff --check

Empower Orchestrator checklist

• I checked whether this PR reveals a repeatable task or recurring agent failure.
• If it does, I either shipped the smallest durable improvement or documented why not.
• Any automation or durable system change included the scale/severity/reversibility/predictability blast-radius check.
• Workers/subagents stayed inside their assigned scope and verification evidence is included before completion claims.