chore(release): reuse GH_PAT for signed-htp cross-repo checkout

GH_PAT is already provisioned for cross-repo access to
qcom-ai-hub/geniex (publish-s3 dispatch). Reuse it for the
overlay-htp sparse checkout instead of requiring a new secret.

Signed-off-by: Mengsheng Wu <mengshen@qti.qualcomm.com>

Author: mengshengwu

.github/workflows/release.yml

@@ -130,7 +130,7 @@ jobs:
           path: signed-htp-src
           sparse-checkout: sdk/signed-htp
           sparse-checkout-cone-mode: false
-          token: ${{ secrets.QCOM_AI_HUB_GENIEX_READ_TOKEN }}
+          token: ${{ secrets.GH_PAT }}
           fetch-depth: 1
 
       - uses: actions/download-artifact@v8

notes/release.md

@@ -172,7 +172,7 @@ The Windows ARM64 SDK ships `libggml-htp.cat` plus `libggml-htp-v{68,69,73,75,79
 
 The signed bundle must contain exactly these eight files at the zip root: `libggml-htp.cat`, `libggml-htp.inf`, and `libggml-htp-v{68,69,73,75,79,81}.so`.
 
-The cross-repo checkout uses `secrets.QCOM_AI_HUB_GENIEX_READ_TOKEN` — a GitHub App / fine-grained PAT scoped to `qcom-ai-hub/geniex` with `contents: read` + `metadata: read`. If CI reports `signed=false` but the bundle is merged on `main`, first check that this secret has not expired.
+The cross-repo checkout reuses `secrets.GH_PAT` (already scoped for cross-repo access to `qcom-ai-hub/geniex` — see `publish-s3` below). If CI reports `signed=false` but the bundle is merged on `main`, first check that `GH_PAT` has not expired.
 
 ### Promoting self-signed → Microsoft-signed