fix: update token for bot_updater

[marcossevilla]

Status

READY

Description

The bot_update_exclusions workflow has failed on 199 of its last 200 runs (the only success, on 2026-08-17, was a run with nothing to change):

##[error]Input 'token' not supplied. Unable to continue.

Both create-pull-request steps use ${{ steps.generate-token.outputs.token }}, but no step has id: generate-token (the reference came in with #178). The expression evaluates to an empty string. So whenever the bot found drift, it never opened a PR, and the README excluded-rules table went stale (fixed in #243). The deprecated-rules step comes after the failing step, so it never ran either.

This switches both steps to the org's VGV_BOT_PAT secret, which is what very_good_cli's bot workflows use.

Type of Change

• ✨ New feature (non-breaking change which adds functionality)
• 🛠️ Bug fix (non-breaking change which fixes an issue)
• ❌ Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Code refactor
• ✅ Build configuration change
• 📝 Documentation
• 🗑️ Chore