The reusable workflow check-pr-message.yml in vyos/.github sets GH_TOKEN: ${{ secrets.PAT }} at the workflow level (line 8). Since this is a workflow_call workflow, caller repos do not have a PAT secret — the variable resolves to an empty string.

This causes the gh pr view commands in both the "Check the PR title" and "Check commit messages" steps to fail with exit code 4 (authentication required), before any title/commit validation actually runs.

Observed in: https://github.com/vyos/gh-action-test-vyos-build/pull/14 — the PR title T8531: restrict Mergify commands to maintainers team is valid but the check fails because gh has no token.

Fix: Replace secrets.PAT with github.token, which is always available to reusable workflows via the caller's implicit GITHUB_TOKEN.