Make PR comment credentials optional

[jmjava]

Summary

• mark the github-token Secret reference optional in the PR-comment Task
• preserve the existing no-token skip behavior
• expand intercept workflow paths to cover product-path implementation changes
• record completed M17.1 and M17.3 acceptance evidence

Failure evidence and resolution

Both live product paths previously passed bootstrap, PR build, intercept deployment, traffic validation, and app tests. Their only failed Task was post-pr-comment, whose pod could not start because github-token was absent despite commenting being optional.

The initial token revision only received lightweight CI because tasks/** was missing from the intercept path filter. The expanded filter triggered the authoritative run.

Verification

• updated Task and workflow YAML parsed successfully
• M17 intercept acceptance tests — 8 passed
• Ruff passed
• local regression — regression exit code: 0
• live intercept run 34890630726 — Telepresence and mirrord trigger-to-traffic jobs passed; both retained evidence artifacts
• strict cluster run 34883804213 — Phase 2 and Newman passed under least-privilege RBAC