Use ALLOWLIST_WORKFLOW_TOKEN and restore branch protection

[potiuk]

Summary

• Use secrets.ALLOWLIST_WORKFLOW_TOKEN with || github.token fallback for checkout and commit steps in all three workflows (update_actions, update_dummy, remove_expired)
• Add a "Print token details" step that displays the token's user/email, expiration, and scopes (only runs when the secret is available)
• Derive commit author name/email from the token identity, falling back to asfgit defaults
• Restore branch protection for main (required PR reviews with 1 approval, status checks) — reverts the revert from Leaving empty protected branches to actually disable it #697

Test plan

• Verify update_actions workflow runs successfully on push to main
• Verify update_dummy workflow runs successfully on push to main
• Verify remove_expired workflow runs successfully via schedule/dispatch
• Verify token details are printed when secret is available
• Verify workflows still work in forks where the secret is not set
• Verify branch protection is active after merge

🤖 Generated with Claude Code

[potiuk]

@raboof @dave2wave -> I need your sanity check if what I display about the token is fine

[dave2wave]

This looks reasonable. Wait for @raboof 's review too.

[dave2wave]

Got @raboof approval through slack.