Enforce public-only token scope for repositories resolved as compare heads. _Assisted-by: Codex:GPT-5_