# Duplicate Authorization header fix

PR #1596 unblocked 9 of 10 steps. The new "Open snapshot PR" step failed with a token-collision issue. One-line fix.

## Symptom

    remote: Duplicate header: "Authorization"
    fatal: unable to access 'https://github.com/yonatangross/orchestkit/':
           The requested URL returned error: 400
    ##[error]The process '/usr/bin/git' failed with exit code 128

## Root cause

`peter-evans/create-pull-request` configures its own git authentication via `http.https://github.com/.extraheader = AUTHORIZATION: basic ***`. When `GH_TOKEN` is also in the env (e.g., set at job-level), git ALSO uses it via the credential helper. Result: two `Authorization` headers go out, GitHub rejects with HTTP 400.

I introduced this in PR #1595 by hoisting `GH_TOKEN` to job-level alongside `CLAUDE_CODE_OAUTH_TOKEN`. The latter MUST be at job-level because it's read in a step-level `if:`. The former does NOT have to be — it's only used by `gh issue create` and `gh issue list`.

## Fix

Move `GH_TOKEN` back to step-level for the two steps that need it; keep `CLAUDE_CODE_OAUTH_TOKEN` at job-level for the `if:` gate.

    jobs:
      watch:
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          # GH_TOKEN intentionally NOT here — collides with peter-evans
          # internal git auth (HTTP 400 "Duplicate header").
        steps:
          ...
          - name: File adoption issues
            env:
              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            run: |
              ...

          - name: Fallback manual-triage issue
            if: steps.triage.outcome == 'skipped'
            env:
              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            run: |
              ...

          - name: Open snapshot PR
            # No env: here. peter-evans manages its own auth.
            uses: peter-evans/create-pull-request@...

## Verification

1. This PR merges to main.
2. Manual `gh workflow run "Claude Release Watch"`.
3. All 10 steps including `Open snapshot PR` finish ✓ success.
4. An auto-PR appears with the snapshot data.