fix(ci): use autofix-bot PAT

.github/workflows/js-autofix.yml

@@ -7,9 +7,11 @@ name: auto-fix lint issues & formatting
 # auto-corrected on merge so PRs aren't blocked by them. The PR-time eslint
 # check in typecheck.yml fails only when un-fixable errors remain.
 #
-# Pushes made by GITHUB_TOKEN don't trigger further workflow runs, so there's
-# no infinite loop — the push to bot/js-autofix and the resulting squash merge
-# to main are both made by GITHUB_TOKEN.
+# NOTE: AUTOFIX_BOT_PAT pushes DO trigger further workflow runs (unlike
+# secrets.GITHUB_TOKEN). The concurrency group (ts-autofix-${{ github.ref }})
+# with cancel-in-progress: true prevents an infinite loop — a re-triggered
+# run cancels the in-flight one, and since the second run finds no new fixes
+# (the first run already applied them), it exits with an empty patch.
 #
 # ── Security model: two-job split ───────────────────────────────────────────
 #
@@ -159,7 +161,7 @@ jobs:
 
       - name: Create/update PR and enable auto-merge
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           BOT_BRANCH: bot/js-autofix
         run: |
           set -euo pipefail
@@ -182,7 +184,7 @@ jobs:
 
       - name: Wait for merge, auto-close on failure or stale
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           START_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail

package-lock.json

@@ -19497,6 +19497,7 @@
       "name": "@hermes/root-tests",
       "devDependencies": {
         "@types/plist": "^3.0.5",
+        "eslint": "^9.39.4",
         "plist": "^3.1.0",
         "typescript": "^6.0.3",
         "vitest": "^4.1.9"