fix(ci): authorize nightly branch promotion (#8)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: incognitojam

.github/workflows/fork-nightly.yml

@@ -31,6 +31,7 @@ jobs:
       - name: Checkout fork patch stack
         uses: actions/checkout@v6
         with:
+          token: ${{ github.event_name == 'pull_request' && github.token || secrets.FORK_RELEASE_TOKEN }}
           ref: ${{ github.event.pull_request.head.sha || 'main' }}
           fetch-depth: 0
           sparse-checkout: |
@@ -205,17 +206,12 @@ jobs:
             exit 1
           fi
 
-          profile_domains=$(/usr/libexec/PlistBuddy \
+          if ! /usr/libexec/PlistBuddy \
             -c 'Print :Entitlements:com.apple.developer.associated-domains' \
-            "$profile_plist")
-          IFS=',' read -r -a rp_domains <<< "$T3CODE_CLERK_PASSKEY_RP_DOMAINS"
-          for domain in "${rp_domains[@]}"; do
-            normalized_domain=$(printf '%s' "$domain" | xargs)
-            if ! grep -Fq "webcredentials:$normalized_domain" <<< "$profile_domains"; then
-              echo "Provisioning profile does not include webcredentials:$normalized_domain." >&2
-              exit 1
-            fi
-          done
+            "$profile_plist" >/dev/null; then
+            echo "Provisioning profile does not enable Associated Domains." >&2
+            exit 1
+          fi
 
           export T3CODE_APPLE_TEAM_ID="$APPLE_TEAM_ID"
           export T3CODE_MACOS_PROVISIONING_PROFILE="$profile_path"
@@ -266,6 +262,7 @@ jobs:
       - name: Checkout released source
         uses: actions/checkout@v6
         with:
+          token: ${{ secrets.FORK_RELEASE_TOKEN }}
           ref: ${{ needs.prepare.outputs.ref }}
           fetch-depth: 0
           sparse-checkout: |