fix(ci): give nightly-spartan-bench wait-for-ci3 a GitHub token (#24909)

## Problem

The Nightly Spartan Benchmarks workflow ([run
29898604670](https://github.com/AztecProtocol/aztec-packages/actions/runs/29898604670),
nightly tag `6.0.0-nightly.20260722`) reported FAILED, but **no
benchmark actually ran**.

The `wait-for-ci3` gate job crashes in <1s at its `Wait for CI3` step.
That step runs `spartan/scripts/wait_for_ci3.ts`, whose first action is
`gh api …` via a synchronous `execSync("gh …")` wrapper. With no GitHub
token in the environment, `gh` errors immediately:

```
gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable.
Error: Command failed: gh api repos/AztecProtocol/aztec-packages/git/ref/tags/v6.0.0-nightly.20260722
##[error]Process completed with exit code 1.
```

The wrapper throws uncaught and the job exits 1. Because all three
deploy tracks (`deploy-bench-network`, `deploy-proving-network`,
`deploy-block-capacity-network`) `needs: wait-for-ci3`, they and every
downstream `wait-*-l2-block` / benchmark job are skipped, the `status`
gate then fails, and the notify jobs fire the FAILED alert.

## Root cause

The `wait-for-ci3` job was added to this workflow on 2026-07-20 in
`9e85829954502af39f9d713529bac44e214e5b70` (*"feat(ci): run next-net,
benches and scenarios from public v6 nightlies"*). Every **other**
workflow that calls `wait_for_ci3.ts` — `deploy-next-net.yml`,
`deploy-staging-public.yml`, `deploy-staging-internal.yml`,
`devnet-deploys.yml` — sets `GITHUB_TOKEN: ${{
secrets.AZTEC_BOT_GITHUB_TOKEN }}` in a **workflow-level `env:` block**,
which `gh` inherits. None of them set it on the step; the `Wait for CI3`
step is bare in all of them. `nightly-spartan-bench.yml` is the only
caller with **no workflow-level `env:` block at all**, so its `gh` call
runs unauthenticated.

(`gh` reads `GH_TOKEN`, then `GITHUB_TOKEN`. The default job
`GITHUB_TOKEN` is not auto-exported to `gh`, and in this run only
carried `contents/metadata/packages: read` — no `actions: read` — so it
would not have sufficed to poll the ci3 run/jobs anyway.)

This was the first scheduled run to exercise the new gate, so it failed
on night one and would recur every night until fixed. It affects all
three nightly tracks (TPS, proving, block-capacity), which all gate on
the same job.

## Fix

Add the workflow-level `env:` block used by all four sibling callers,
rather than a one-off step-level token:

```yaml
env:
  GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
```

`AZTEC_BOT_GITHUB_TOKEN` is already referenced by the benchmark jobs in
this same workflow, so it is available. Workflow-level `env` does not
propagate into the reusable `deploy-network.yml` workflows invoked via
`uses:`, so this only affects the run steps that need it.

## Testing

Workflow-only change; the benchmarks require the deployed Spartan
networks and cloud credentials, so behavior can only be verified on the
next live scheduled run (or a `workflow_dispatch`). The `gh` invocation
now inherits a token with `actions: read`, matching the pattern already
proven in the four other `wait_for_ci3.ts` callers.

Author: PhilWindle

.github/workflows/nightly-spartan-bench.yml

@@ -14,6 +14,9 @@ concurrency:
   group: nightly-spartan-bench-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+
 jobs:
   select-image:
     if: ${{ github.repository == 'AztecProtocol/aztec-packages' }}