Configure GITLAB_TOKEN for fetch runs before expanding GitLab repo lists

[Arvin21M]

The fetch currently hits gitlab.com unauthenticated. build.yml passes
GITHUB_TOKEN (from secrets.HEARTBEAT_PAT) to the fetch step but no
GITLAB_TOKEN, and refresh.yml only pings the Vercel deploy hook. The
provider (scripts/providers/gitlab.ts) already reads
process.env.GITLAB_TOKEN and sends it via the PRIVATE-TOKEN header, and
the README documents the variable — it's just never supplied in CI.

This was fine with one GitLab repo, but #<issue 1> and #<issue 2> add ~32.
Each repo costs a project lookup plus paginated commits/MRs/issues/releases
requests, so a refresh becomes a few hundred GitLab calls from a shared
CI/Vercel IP. Throttled requests currently fail the repo for that run (see
#<429 issue>).

Tasks:

• Create a GitLab Personal Access Token, read_api scope only
• Add it as repo secret GITLAB_TOKEN
• Add GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }} to the fetch step env
  in build.yml
• Confirm where the fetch actually executes (Actions vs Vercel build);
  if Vercel, set the env var there too
• Note token rotation/expiry somewhere (GitLab PATs can expire)