ci(risc0): pass GITHUB_TOKEN as secret env to fix rzup rate limits

[Andrurachi]

Fixes #41

Injects GITHUB_TOKEN into the Risc0 Docker build via BuildKit secret mount (env=GITHUB_TOKEN). This prevents the rzup installer from hitting GitHub API rate limits in CI.

[Andrurachi]

Hey @han0110 ,

It looks like the token fix successfully bypassed the rate limit, but it caused ziskup to fetch the latest unpinned version of ZisK (v0.16.1).

It looks like v0.16.1 broke the Docker builds for two reasons:

• ziskup now triggers an interactive prompt asking to select CPU vs GPU, which crashes the CI runner (/dev/tty: No such device or address).
• The binary structure seems to have changed, breaking the mv cargo-zisk-gpu command in the install script.

I see you just opened #351 to update ZisK to v0.17.0 (which I assume handles these changes). Once your PR is merged, I can rebase this branch on top of it. Let me know if you'd prefer me to handle this differently in the meantime :)

[han0110]

Checked the last 3 months workflow github rate limiting failures, all come from rzup installation, which only requires pass GITHUB_TOKEN to risc0's installation script:

RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN \
    /tmp/install_risc0_sdk.sh && rm /tmp/install_risc0_sdk.sh

The rest changes seem not necessary and overkill given the complexity.

[han0110]

Thanks for the PR!