ci: Fall back to github.token when COMMAND_BOT_PAT is unavailable

[AndyScherzinger]

Summary

Follow-up to #756, which switched GH_TOKEN to secrets.COMMAND_BOT_PAT. Dependabot- and fork-triggered pull_request runs don't receive repository/organization Actions secrets, so the PAT resolves to an empty string and gh exits with code 4 on the very first step (see the failing runs on #757 and #758).

This adds a fallback so those runs use the default workflow token instead:

GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}

• The collect step only reads commit messages, which the default read-only token can always do — this unblocks Dependabot and fork PRs.
• The label steps still prefer the PAT when available; they only fire when AI trailers are detected, which won't happen on Dependabot PRs.

Applied to both the live workflow and the org template.

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

🤖 Generated with Claude Code