Default GITHUB_TOKEN cannot mutate Repository Variables (always 403). Use a PAT-backed secret CTO_ADMIN_TOKEN for the budget counter steps. Also restores formal APPROVE/REQUEST_CHANGES verdicts now that repo setting can_approve_pull_request_reviews is enabled. Agent-Session: cowork-reviewer-ab-20260414