ci: skip App token on PRs in nix-build

Fork PRs cannot read repo secrets, so the App-token step failed with
'Input required and not supplied: app-id'. Gate the App-token step on
push-to-main and fall back to github.token for the checkout on PRs,
since PRs only need to validate the build.

.github/workflows/nix-build.yml

@@ -42,6 +42,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/create-github-app-token@v1
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         id: app-token
         with:
           app-id: ${{ secrets.PASEO_BOT_APP_ID }}
@@ -50,7 +51,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - uses: actions/setup-node@v4
         with: