chore: fix workflow token secret name

- use CLAWDINATOR_WORKFLOW_TOKEN instead of GITHUB_WORKFLOW_TOKEN
- update infra README

.github/workflows/fleet-deploy.yml

@@ -29,7 +29,7 @@ jobs:
       TF_BACKEND_DYNAMO_TABLE: clawdinator-terraform-locks
       TF_VAR_control_api_enabled: true
       TF_VAR_control_api_token: ${{ secrets.CONTROL_API_TOKEN }}
-      TF_VAR_github_token: ${{ secrets.GITHUB_WORKFLOW_TOKEN }}
+      TF_VAR_github_token: ${{ secrets.CLAWDINATOR_WORKFLOW_TOKEN }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

infra/opentofu/aws/README.md

@@ -63,7 +63,7 @@ export TF_VAR_github_token=...
   - `S3_BUCKET`
   - `CLAWDINATOR_SSH_PUBLIC_KEY`
   - `CONTROL_API_TOKEN`
-  - `GITHUB_WORKFLOW_TOKEN`
+  - `CLAWDINATOR_WORKFLOW_TOKEN`
 
 ## Runtime bootstrap
 - Instances get an IAM role with read access to `s3://${S3_BUCKET}/bootstrap/*` for secrets + repo seeds.