Support source token env for artifact selectors

[shiny-code-bot]

Summary

• let artifact selector resolution use dedicated source-token environment variables before generic GitHub tokens
• cover both ODOO_DEVKIT_SOURCE_GITHUB_TOKEN and CI-facing ODOO_SOURCE_GITHUB_TOKEN fallbacks
• document the publish-time credential split

Tests

• uv run python -m unittest tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_uses_environment_token_fallback tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_uses_dedicated_source_token_env tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_supports_ci_source_token_env tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_prefers_runtime_github_token
• uv run ruff format --check odoo_devkit/local_runtime.py tests/test_runtime.py
• uv run ruff check odoo_devkit/local_runtime.py tests/test_runtime.py