Restore CLA gate after PAT-backed repository reads return 401

[enricopiovesan]

Summary

The required reusable CLA gate is failing every owner-authored Traverse PR with:

Could not retrieve repository contents. Status: 401

The workflow detects a configured CLA_ASSISTANT_PAT, enters enforcement mode, and then contributor-assistant/github-action@v2.6.1 cannot read traverse-framework/.github on branch cla-signatures. This prevents the documented allowlist fallback, which only runs when the PAT is absent.

Current impact

• traverse PR #711
• traverse PR #714
• traverse PR #715

All completed non-CLA required checks on #711 and #714 are green. The same failure has repeated across new commits and independent PRs.

Requested fix

• rotate or correct the CLA_ASSISTANT_PAT secret and confirm it can read repository contents and write the signature branch as required; or
• make the reusable workflow fall back to its owner/bot allowlist when the action reports an authentication failure, while continuing to fail closed for external contributors.

Validation

Re-run the CLA workflow on #711, #714, and #715 and confirm cla / cla succeeds without bypassing branch protection.

[enricopiovesan]

Resolved after rotating CLA_ASSISTANT_PAT. Fresh CLA checks passed and Traverse PRs #711, #714, and #715 merged without bypass.