- Add aarch64|arm64 architecture detection in setup-common.sh
- Add linux-aarch64 -> aarch64-unknown-linux-gnu mapping in setup-codex.sh
- Fixes smoke test failures on ARM64 Linux runners
- Enables Codex runtime installation on ARM64 Linux systems

Fixes smoke test error: 'Unsupported Linux architecture: aarch64'

- Add aarch64|arm64 -> apm-linux-aarch64 mapping in test-integration.sh
- Fixes integration test failures on ARM64 Linux runners
- Complements runtime setup ARM64 support

This was the missing piece causing integration tests to fail with:
'Unsupported Linux architecture: aarch64'

- Add GITHUB_APM_PAT as fallback for models token purpose
- Ensure both GITHUB_TOKEN and GITHUB_APM_PAT are available to Codex script
- Fixes 'Using unauthenticated GitHub API request' in CI smoke tests

The smoke test environment only provides GITHUB_APM_PAT but not GITHUB_TOKEN.
The token manager now properly falls back to GITHUB_APM_PAT for GitHub Models
API access when GITHUB_TOKEN is not available, and ensures the Codex setup
script has access to both tokens as expected.

- Change apm-linux-aarch64 to apm-linux-arm64 in test-integration.sh
- Matches build script normalization: aarch64 -> arm64
- Fixes 'Binary not found: ./dist/apm-linux-aarch64/apm' error

The build script normalizes aarch64 architecture to arm64, creating
apm-linux-arm64 binary, but integration test was looking for
apm-linux-aarch64. Now both use consistent arm64 naming.

- Add debug prints to _setup_codex_tokens to see what tokens are available
- This will help diagnose why Codex setup is still using unauthenticated requests
- Temporary debugging commit to understand token flow in CI

Will remove debug prints once issue is identified and fixed.

- Add env=os.environ.copy() to subprocess.run() in run_command()
- Ensures GITHUB_APM_PAT and other environment variables are properly
  passed to the shell scripts in smoke tests
- Fixes authentication issue where runtime setup scripts couldn't
  access GitHub tokens set in CI workflow

Root cause: subprocess.run() with shell=True may not always inherit
all environment variables properly, especially in test environments.

- Revert debug logging added for troubleshooting
- Keep only the core fix for subprocess environment passing

- Ensures tokens are available for GitHub API requests to fetch latest release
- Fixes 'Using unauthenticated GitHub API request' in CI environments
- API call at line ~97 needs tokens set up early, not at line 171
- Addresses timing issue where tokens were configured after API usage

- Smoke tests now have both GITHUB_TOKEN and GITHUB_APM_PAT like other test jobs
- Maps GH_MODELS_PAT → GITHUB_TOKEN for GitHub API authentication
- Maps GH_CLI_PAT → GITHUB_APM_PAT for APM module access
- Fixes 'Using unauthenticated GitHub API request' in smoke test step
- Makes smoke test environment consistent with integration-tests and release-validation

- Add detailed environment variable debugging to github-token-helper.sh
- Show initial and final token state with character counts
- Add debug logging to setup-codx.sh before GitHub API calls
- Add environment debugging to test_runtime_smoke.py subprocess calls
- Debug output will show exactly which tokens are available and being used
- Helps diagnose why CI shows 'unauthenticated' despite token setup success

This will reveal the exact root cause of authentication failure in CI.

- Change from pull_request to pull_request_target
- Enables secrets access for fork PRs while maintaining security
- Revert to proper secrets (GH_MODELS_PAT, GH_CLI_PAT, GH_PKG_PAT)
- Add security documentation for pull_request_target usage

Fixes GitHub Actions fork PR limitation where custom secrets
are not available, while preserving full functionality for
regular PRs and main branch builds.

- Revert from pull_request_target to pull_request for proper security
- This prevents automatic secrets exposure to untrusted fork code
- Fork PRs will now require manual approval workflow as intended
- Maintains GitHub's security model for open source projects

This addresses the security concern where pull_request_target would
automatically grant secrets access without approval, bypassing
GitHub's built-in fork protection mechanisms.