Harden log-mirroring setup to use LOGS_REPO_PAT secret and remove plaintext token handling

[Copilot]

The setup request relied on a raw PAT being shared directly, which is unsafe and brittle for automation. This change routes authentication through GitHub Actions secrets and makes the log-mirroring path explicit and reproducible.

• Secret-based auth for cross-repo writes

  • Updated workflow auth to use ${{ secrets.LOGS_REPO_PAT }} for checkout/push to th30d4y/LOGS.
  • Added guardrails to fail early when the secret is missing rather than proceeding with partial execution.

• Event logging pipeline clarity

  • Kept event mirroring append-only into daily JSONL partitions (openlearnx-events/YYYY-MM-DD/events.jsonl) to preserve auditability and simplify downstream ingestion.

• Setup documentation

  • Documented required PAT scope and repository secret name (LOGS_REPO_PAT) so operators can complete setup without exposing credentials in code, commits, or PR text.

- uses: actions/checkout@<pinned-sha>
  with:
    repository: th30d4y/LOGS
    token: ${{ secrets.LOGS_REPO_PAT }}
    path: logs-repo