Use CI trigger token for Evergreen preflight

Author: mrjf

.github/workflows/evergreen.lock.yml

@@ -54,7 +54,7 @@ jobs:
         name: Evaluate PR gate state
         shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           EVENT_NAME: ${{ github.event_name }}
           EVENT_ACTION: ${{ github.event.action }}

.github/workflows/evergreen.md

@@ -98,8 +98,8 @@ readiness controller and the agentic orchestrator must both respect this file.
   through safe outputs by the agent (never from preflight) and labeled
   `evergreen: trigger CI`; they do not count as semantic repair attempts.
 - Token policy: `GITHUB_TOKEN` for reads and control-plane label writes.
-  `GH_AW_CI_TRIGGER_TOKEN` (existing PAT) is used by gh-aw for pushes so that PR
-  branch pushes trigger CI (default-token pushes do not).
+  `GH_AW_CI_TRIGGER_TOKEN` (existing PAT) is used by gh-aw for CI reruns and
+  pushes so that PR branch pushes trigger CI (default-token pushes do not).
 
 ## Repair Policy