workflow-file dep PRs fail silently when BUDDY_BOT_TOKEN is absent

Symptom

When the GitHub Actions group of a buddy-bot run includes a workflow-file update (e.g. .github/workflows/*.yml), the run:

1. ✅ Creates the branch
2. ❌ Fails to commit/push the workflow file change
3. ❌ Fails to create the PR
4. Leaves the branch behind → orphan

Example from stacksjs/bun-query-builder (run):

Creating PR for group: GitHub Actions (5 updates)
🔄 Branch buddy-bot/update-github-actions already exists, checking for associated PR...
🧹 Branch buddy-bot/update-github-actions exists but has no open PR, cleaning up...
❌ Failed to commit changes to buddy-bot/update-github-actions with Git CLI: ...
⚠️ Git CLI commit failed, falling back to GitHub API: ...
❌ Failed to commit changes to buddy-bot/update-github-actions: ...
❌ Failed to create PR for group GitHub Actions: ...

Root cause

GITHUB_TOKEN cannot push to .github/workflows/* files — GitHub blocks workflow-file modifications from default tokens. Buddy-bot already detects this earlier (⚠️ Detected N workflow file(s). These require elevated permissions.) but proceeds to attempt the commit anyway, which then fails.

The README documents this: BUDDY_BOT_TOKEN (PAT with repo+workflow scopes) is required for workflow file updates. But when the secret is missing, the run doesn't detect-and-skip — it tries and silently fails per group.

Fix suggestions

Two options, in order of preference:

1. Detect-and-skip at start of update: when BUDDY_BOT_TOKEN is absent AND the group contains only workflow files, skip the group entirely (no branch creation). Log a clear ℹ️ Skipping GitHub Actions group — BUDDY_BOT_TOKEN missing message.
2. Detect-and-warn loudly: emit a single bold warning at the start of the run rather than per-group failure spam. Still skip the group.

Either way, the branch shouldn't be created if we know the PR can't be opened.

Blast radius

Every stacksjs repo running buddy-bot without BUDDY_BOT_TOKEN configured accumulates orphan buddy-bot/update-github-actions branches. Cleanup catches them on the next daily run, but they shouldn't be created in the first place.