Fix CI: Use GITHUB_TOKEN fallback for PR tests

Use GITHUB_TOKEN when TOKEN_READONLY secret isn't available (PRs from forks).
This allows tests to run on all PRs while still using the higher-limit PAT
when available on pushed branches.

Author: choldgraf

.github/workflows/tests.yaml

@@ -35,9 +35,9 @@ jobs:
   tests:
     runs-on: ubuntu-24.04
     env:
-      # This is a PAT for @choldgraf that only has read-access to this repo.
-      # We use it to avoid query limits.
-      GITHUB_ACCESS_TOKEN: "${{ secrets.TOKEN_READONLY }}"
+      # Use TOKEN_READONLY if available (pushed branches), otherwise use GITHUB_TOKEN (PRs)
+      # TOKEN_READONLY is a PAT for @choldgraf that only has read-access to this repo.
+      GITHUB_ACCESS_TOKEN: "${{ secrets.TOKEN_READONLY || secrets.GITHUB_TOKEN }}"
     strategy:
       matrix:
         include: