Rename CI tokens to org-wide names and drop the Incus checkout token

[MickLesk]

✍️ Description

Every secret this repo used carried a name that described one caller rather than the credential itself, so the same PAT lived under three names across the org. Both now point at one org-level secret.

CHANGELOG_DISPATCH_TOKEN -> GH_CROSS_REPO_TOKEN

The Incus checkout token goes away entirely: the comment claiming Incus is private is stale -- the repo is public and anonymously readable, so the default GITHUB_TOKEN reaches it and the
INCUS_REPO_TOKEN/PAT_MICHEL fallback chain was dead weight.

🔗 Related Issue

Fixes #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected (Proxmox VE and/or Incus, as applicable).
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
• API.txt regenerated – If a function signature or behavior changed, API.txt was updated to match.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any code in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Code was written without AI assistance.
• AI was used – The output has been reviewed and corrected, and I take responsibility for it matching this repo's conventions.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing behavior in a way that may require updates in every downstream script.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, docs/, CONTRIBUTING.md, or other docs.