fix(ci): pin CI doctor model

[BenjaminMichaelis]

Summary

• pin CI Failure Doctor to gpt-5.6 instead of the dynamic auto alias
• use organization-billed GitHub Actions-token inference with copilot-requests: write
• regenerate the tracked gh-aw lock workflow

Why retain this change

The original failure in run 35349118559 attempt 1 was caused by the value then stored in COPILOT_GITHUB_TOKEN: its model-catalog request returned 401 before the agent launched.

After the PAT was regenerated, attempt 2 of the same run used the unchanged wizard-generated PAT wiring, fetched the catalog, resolved auto to claude-sonnet-5, and began Copilot inference before it was intentionally cancelled. This rules out a systematic secret-binding defect in gh aw add-wizard or the generated lock file. The earlier provider-qualified PAT probe predates the replacement token and is no longer evidence about the regenerated token.

The Actions-token path successfully completed inference with gpt-5.6 in run 35420142488. It also authenticated and fetched the catalog with auto, but selected gpt-5.6-luna-utility, which Copilot CLI rejected with 400 because that model is not accessible through /chat/completions. Retain explicit gpt-5.6 for deterministic CI Doctor behavior.

Validation

• gh aw compile ci-doctor --strict
• GitHub Actions-token inference with gpt-5.6 succeeded: 35420142488
• GitHub Actions-token auto authenticated but failed only after model selection: 35423228746
• regenerated PAT with auto fetched the catalog and started Copilot inference in attempt 2 of 35349118559; the run was intentionally cancelled

[BenjaminMichaelis]

@copilot resolve the merge conflicts in this pull request

drop the pin CI Failure Doctor to gpt-5.6 instead of the dynamic auto alias change.

keep use organization-billed GitHub Actions-token inference with copilot-requests: write if it's not done.
regenerate the tracked gh-aw lock workflow.

[Copilot]

@copilot resolve the merge conflicts in this pull request

drop the pin CI Failure Doctor to gpt-5.6 instead of the dynamic auto alias change.
...

Done in 70e2ad4. I merged main, resolved the conflicts and removed the gpt-5.6 pin, so CI Doctor goes back to the dynamic auto default. main already had copilot-requests: write with COPILOT_GITHUB_TOKEN: ${{ github.token }}, so I didn't need to add it again. I regenerated ci-doctor.lock.yml with gh aw compile ci-doctor --strict (v0.91.4). Compared with main, the only changes are the model lines. Nothing has run with this version yet. Note that an earlier run on the Actions token with auto chose gpt-5.6-luna-utility and failed with a 400, so that may happen again.