fix: avoid app token in changeset verification

[omribz156]

Summary:

• removed the GitHub App token generation from the changeset verification workflow
• let actions/checkout use the default read-only token so fork PRs do not need repository secrets
• removed the now-unused GITHUB_TOKEN env from the verifier step

Verification:

• node --check .github/workflows/actions/verify-changesets/index.js
• direct verifyChangesets() smoke test with a valid patch changeset
• git diff --check -- .github/workflows/verify-changesets.yml .github/workflows/actions/verify-changesets/index.js
• actionlint .github/workflows/verify-changesets.yml

This keeps the workflow on pull_request instead of moving to pull_request_target, so fork PR validation remains unprivileged. It addresses the fork-secret failure path from #520; I left the separate missing-changeset guidance behavior alone because that likely needs a maintainer preference on whether to comment, warn, or enforce.

Implemented with Codex assistance, with the workflow change kept focused and manually reviewed.

[vercel]

@omribz156 is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.