Add GITHUB_PAT for enterprise-level runner registration

[existemi]

Description

Add GITHUB_PAT so runners can be registered at the enterprise level.

GitHub does not grant the manage_runners:enterprise permission to GitHub App installations, so an App-authenticated request to the enterprise registration-token endpoint is rejected with 403 Resource not accessible by integration no matter where the App is installed. A classic personal access token is the only supported way to register runners at the enterprise level, which is the same limitation the Actions Runner Controller documents.

• Add GITHUB_PAT, which selects the SDK's personal access token client instead of the GitHub App client
• Make the GITHUB_APP_* variables optional when GITHUB_PAT is set, and log which authentication method is in use
• Fail at startup with an actionable message when GITHUB_URL points at an enterprise and no PAT is provided, rather than surfacing a bare 403 from the registration call
• Report a single error naming both authentication options when neither is configured, instead of three GitHub App errors that never mention the PAT
• Remove the Orka validation that was duplicated between ParseEnv and validateEnv, which printed each of those errors twice

The token must be a classic token with the admin:enterprise (manage_runners:enterprise) scope, owned by an enterprise owner. Fine-grained tokens do not expose enterprise scopes.

Testing

1. Deploy against a GitHub Enterprise Server instance with GITHUB_URL pointing at an enterprise and GITHUB_PAT set. The runner authenticates, creates the runner scale set, and begins processing messages.
2. Start with an enterprise GITHUB_URL and no GITHUB_PAT. Startup fails with a message naming the required token and scope.
3. Start with GITHUB_PAT set and no GITHUB_APP_* variables present at all. Startup succeeds and the log reports that the personal access token is in use.
4. Start with neither GITHUB_PAT nor any GITHUB_APP_* variable. Startup fails with one message naming both authentication options.
5. Start with an invalid Orka configuration and confirm each validation error is printed once.

[ispasov]

LGTM. The PAT-vs-App auth selection is clean, the enterprise-URL-without-PAT guard gives a clear actionable error, precedence is documented, and the IsEnterpriseConfigURL table tests cover the edge cases (trailing slash, mixed case, repo-named-"enterprises", missing name). Verified the env refactor relocated the Orka token/config/metadata validations into validateEnv rather than dropping them.