Fix workflow utility scripts to use requests and structural PyYAML edits

[github-actions]

Summary

Closes #2163.

This PR implements both framework-best-practices findings in the utility scripts and adds focused regression tests:

• Refactored scripts/fetch-workflow-logs.py from manual urllib requests to requests.Session with centralized headers (Authorization, API version, accept), explicit timeout handling, raise_for_status(), and pagination via GitHub next links.
• Refactored scripts/wire-ephemeral-token.py to structural YAML mutation with yaml.safe_load/safe_dump for id-token: write injection on token-minting jobs.
• Added explicit failure behavior when a job mints create-token but lacks a permissions mapping, instead of silently skipping.
• Extended tests in tests/test_fetch_workflow_logs.py and tests/test_wire_ephemeral_token.py to cover auth header wiring, pagination behavior, indentation-variant YAML handling, and missing-permissions failure.

Validation

UV_CACHE_DIR=/tmp/gh-aw/agent/uv-cache uv run --extra test pytest tests/test_fetch_workflow_logs.py tests/test_wire_ephemeral_token.py -q

(13 passed)

Pre-Completion Checklist

• Re-read the issue or request and confirmed this PR directly addresses it
• Reviewed all changed files for correctness
• Ran make compile and make lint with no errors
• Verified no unrelated files were modified

---

What is this? | From workflow: Trigger Framework Best Practices

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.