fix(publish): push 憑證改 header 注入

scripts/publish-github.sh

@@ -62,6 +62,12 @@ if [ "${1:-}" = "--push" ]; then
   fi
   git remote remove github 2>/dev/null || true
   git remote add github "$GITHUB_REMOTE"
+  # 憑證不進 URL/指令行：有 GITHUB_MIRROR_TOKEN 就用 Basic header 注入（PAT）
+  if [ -n "${GITHUB_MIRROR_TOKEN:-}" ]; then
+    AUTH_B64="$(printf '%s:%s' "${GITHUB_ACCOUNT_NAME:-git}" "$GITHUB_MIRROR_TOKEN" | base64 | tr -d '\n')"
+    git -c http."$GITHUB_REMOTE".extraheader="Authorization: Basic $AUTH_B64" push -u github main
+  else
     git push -u github main
+  fi
   echo "🚀 已 push → $GITHUB_REMOTE"
 fi