ci(verify): author the verify analysis comment as TechEngineBot

Use TECHENGINEBOT_TOKEN (the bot's PAT) for the github-script step so the Tier 0
analysis comment is authored by TechEngineBot, falling back to ENGINE_TOKEN only
to keep the workflow running if the bot token is absent. Refs #1

Author: Seungpyo1007

.github/workflows/verify-report.yml

@@ -2,12 +2,13 @@ name: verify-report
 
 # Run the Tier 0 offline data *verification* (existence/trust scoring) on a PR and
 # let TechEngineBot post the band analysis as a PR comment. The bot owns the
-# analysis surface: this workflow only computes the report and hands it to the bot
-# (the comment is authored via the bot's token). It never gates a merge.
+# analysis surface: this workflow only computes the report and hands it to the bot,
+# which authors the comment via its own PAT (TECHENGINEBOT_TOKEN). It never gates a
+# merge.
 #
-# Dormant unless ENGINE_TOKEN (TechEngineBot's PAT) is configured. Restricted to
-# same-repo branch PRs so fork PRs never see the token. The structural gate stays
-# in validate-data.yml; this is purely informational.
+# Dormant unless a bot/automation token is configured. Restricted to same-repo
+# branch PRs so fork PRs never see the token. The structural gate stays in
+# validate-data.yml; this is purely informational.
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
@@ -30,24 +31,27 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
     env:
       PYTHONIOENCODING: utf-8
-      ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }}
+      # Prefer TechEngineBot's PAT so the analysis comment is authored by the bot
+      # (TECHENGINEBOT_TOKEN, Issues/PR write on both repos). Fall back to
+      # ENGINE_TOKEN only so the workflow still runs if the bot token is absent.
+      BOT_TOKEN: ${{ secrets.TECHENGINEBOT_TOKEN || secrets.ENGINE_TOKEN }}
     steps:
-      - name: Dormant when ENGINE_TOKEN is unset
-        if: env.ENGINE_TOKEN == ''
-        run: echo "::warning::ENGINE_TOKEN not configured — TechEngineBot verify comment skipped."
+      - name: Dormant when no bot token is configured
+        if: env.BOT_TOKEN == ''
+        run: echo "::warning::No TECHENGINEBOT_TOKEN/ENGINE_TOKEN — TechEngineBot verify comment skipped."
 
       - uses: actions/checkout@v4
-        if: env.ENGINE_TOKEN != ''
+        if: env.BOT_TOKEN != ''
         with:
           fetch-depth: 0
 
       - uses: actions/setup-python@v5
-        if: env.ENGINE_TOKEN != ''
+        if: env.BOT_TOKEN != ''
         with:
           python-version: "3.12"
 
       - name: Tier 0 verification (changed + full baseline)
-        if: env.ENGINE_TOKEN != ''
+        if: env.BOT_TOKEN != ''
         id: verify
         run: |
           git fetch origin main --depth=1 || true
@@ -62,12 +66,12 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: TechEngineBot posts the verification analysis
-        if: env.ENGINE_TOKEN != ''
+        if: env.BOT_TOKEN != ''
         uses: actions/github-script@v7
         env:
           REPORT: ${{ steps.verify.outputs.report }}
         with:
-          github-token: ${{ secrets.ENGINE_TOKEN }}
+          github-token: ${{ secrets.TECHENGINEBOT_TOKEN || secrets.ENGINE_TOKEN }}
           script: |
             const marker = '<!-- techengine-verify-report -->';
             const report = (process.env.REPORT || '').trim() || '(no output)';