Harden Vally pull_request auth path by adding token fallback and source diagnostics

[Copilot]

Vally evaluations / eval-job (pull_request) was failing because all eval sessions were launched without usable Copilot auth when COPILOT_GITHUB_TOKEN was unavailable (common in forked PR contexts). This caused every stimulus to error before execution.

• Auth token resolution for PR evals

  • Updated .github/workflows/vally-eval.yml to set COPILOT_GITHUB_TOKEN from secrets.COPILOT_GITHUB_TOKEN with fallback to github.token, so vally can still initialize sessions when repo secrets are not exposed.

• Failure diagnosability

  • Added a dedicated workflow step before Run vally that emits whether the secret-backed token is present vs fallback path, without exposing token material.

• Security-conscious implementation detail

  • Presence check is done via an env var (COPILOT_TOKEN_SECRET) in PowerShell, avoiding direct secret interpolation in script text.

env:
  COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN || github.token }}

- name: Resolve Copilot auth token source
  shell: pwsh
  env:
    COPILOT_TOKEN_SECRET: ${{ secrets.COPILOT_GITHUB_TOKEN }}
  run: |
    if ($env:COPILOT_TOKEN_SECRET) {
      Write-Host 'Using COPILOT_GITHUB_TOKEN secret for vally auth.'
    }
    else {
      Write-Host '::notice::COPILOT_GITHUB_TOKEN secret is unavailable; falling back to github.token for vally auth.'
    }

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.