[agent-issue]: align GitHub issue-reporting token variable names

## Submission requirements

- [x] I generated this issue with an agent that used the repository's ado-aw guidance.
- [x] I reviewed the generated issue and confirm it is being filed directly in `githubnext/ado-aw`.

## Problem summary

The same GitHub fine-grained PAT contract—an executor/harness-only token scoped
to create failure-reporting issues—is represented by three ADO pipeline
variable names:

- `ADO_AW_DEBUG_GITHUB_TOKEN`
- `EXECUTOR_E2E_GITHUB_TOKEN`
- `TRIGGER_E2E_GITHUB_TOKEN`

This makes token rotation and pipeline setup unnecessarily error-prone. A single
credential rotation currently requires setting three differently named
variables across the release/candidate failure reporters and both deterministic
E2E orchestrators.

The issue-reporting PAT must remain distinct from `GITHUB_TOKEN`, which
authenticates the Copilot CLI.

## Reproduction details

Current consumers:

- `src/safe_outputs/result.rs` loads `ADO_AW_DEBUG_GITHUB_TOKEN` for
`ado-aw-debug.create-issue`.
- `tests/executor-e2e/azure-pipelines.yml` maps
`EXECUTOR_E2E_GITHUB_TOKEN`.
- `tests/trigger-e2e/azure-pipelines.yml` maps
`TRIGGER_E2E_GITHUB_TOKEN`.
- `scripts/ado-script/src/executor-e2e/github-issue.ts` and
`scripts/ado-script/src/trigger-e2e/github-issue.ts` already fall back to
`ADO_AW_DEBUG_GITHUB_TOKEN`, demonstrating that these names represent the
same underlying capability.

The duplication is also repeated throughout setup documentation and secret
rotation scripts.

## Proposed next step

Choose one capability-oriented canonical name, for example
`ADO_AW_GITHUB_ISSUES_TOKEN`, and migrate every issue-reporting consumer to it.

Suggested acceptance criteria:

1. Release and candidate smoke reporters, executor E2E, and trigger E2E use one
documented canonical ADO secret-variable name.
2. The canonical variable remains executor/harness-only and is never exposed to
Stage 1.
3. `GITHUB_TOKEN` remains a separate Copilot authentication credential.
4. Existing names are accepted as deprecated aliases for a bounded migration
window, with deterministic precedence and tests.
5. Compiler output, TypeScript harnesses, tests, examples, runbooks, registered
pipeline instructions, and rotation scripts are updated together.
6. The migration documents which AgentPlayground definitions require the
renamed variable and how operators can rotate it safely.

Start by tracing the token handling in src/safe_outputs/result.rs, both Azure Pipelines files, and the executor-e2e and trigger-e2e github-issue.ts files, then search setup documentation and rotation scripts for all three names. Run the relevant executor and trigger E2E tests after updating consumers, aliases, and documentation; done means all issue reporters use one documented canonical variable with deterministic deprecated-alias behavior while GITHUB_TOKEN remains separate.

Written by the indexing model from the issue text.