generic: authenticate eels simulator-build clones with the job token

[danceratopz]

Adds --sim.buildarg github_token=${{ github.token }} to the three eels simulator flag blocks in the generic workflow, so the git clone of execution-specs inside the simulator image builds authenticates instead of running anonymously.

Motivation

GitHub rate-limits anonymous git-over-HTTPS per source IP, and the shared runners intermittently hit the limit. When that happens the simulator image build dies before any test runs and the job fails within minutes:

fatal: could not read Username for 'https://github.com': No such device or address
fatal: expected flush after ref listing
ERR image build failed image=hive/simulators/ethereum/eels/consume-engine:latest ...

Recent examples: consume-engine, nethermind and consume-engine, reth on 2026-09-02. The same failure has been observed in ethereum/execution-specs CI and other EF repo infra on the same runner pool. GitHub tightened unauthenticated rate limits in May 2025 and documents authentication as the supported remedy.

Notes

• The github_token build-arg lands in the Dockerfiles via internal/libhive,simulators/ethereum/eels: support optional authenticated GitHub clones, redact token from recorded commands ethereum/hive#1606. Until that merges, this flag is a no-op: the classic builder emits an unused build-arg warning and the clone stays anonymous.
• github.token is the job-scoped Actions token: it needs no provisioning, works for cloning public repos, and expires when the job ends. The runner masks it in logs and job summaries.
• The consume-sync and execute-blobs simulators also accept the build-arg but are not run by this workflow, so no flags are added for them.

[spencer-tb]

If we use the BuildKit secret interface proposed in danceratopz/hive#3 here, please replace all three token build arguments with:

--sim.buildsecret id=github_token,env=HIVE_GITHUB_TOKEN

Then scope the token to the Hive action step:

- uses: ethpandaops/hive-github-action@master
  env:
    HIVE_GITHUB_TOKEN: ${{ github.token }}
  with:

This keeps the credential out of extra_flags, Hive's argv, logs, public result metadata, and Docker image history :)

Approving nonetheless, thanks!!

[spencer-tb]

Don't merge please until Dan is finished!