Use GH_AW_CODEOWNER_PR_TOKEN for PR creation in codeowner-update

Scoped custom token only to create-pull-request safe output.
All other operations use default token fallback chains.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: aaronpowell

.github/workflows/codeowner-update.lock.yml

@@ -16,6 +16,7 @@ safe-outputs:
     base-branch: staged
     title-prefix: "[codeowner] "
     draft: false
+    github-token: ${{ secrets.GH_AW_CODEOWNER_PR_TOKEN }}
   add-comment:
     max: 1
   noop: