Step 1 also needs GH_TOKEN

Regression caught by the smoke-test dispatch after PR #1597. One-line follow-up.

What happened

PR #1597 moved GH_TOKEN from job-level to per-step (to avoid the peter-evans duplicate-Authorization-header collision). I added it to Steps 3 and 4 (the gh issue ones) but missed Step 1.

Step 1 (cc-release-watch.mjs) calls gh api repos/anthropics/claude-code/contents/CHANGELOG.md to fetch the upstream CHANGELOG. Without GH_TOKEN:

gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN
environment variable. Example:
  env:
    GH_TOKEN: ${{ github.token }}

Fix

- name: Snapshot CC CHANGELOG and score gaps
  id: watch
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: node scripts/cc-release-watch.mjs

Verification

  1. This PR merges.
  2. Manual gh workflow run "Claude Release Watch".
  3. All 10 steps succeed including Step 1 and Step 7 (Open snapshot PR).