Add gh auth token - #6324

introduced in cli/cli#6324

Utilization of `gh auth status` to obtain the token is a legacy method,
cli/cli#2157 which was replaced with
`gh auth token` command, cli/cli#6324

Utilization of `gh auth status` to obtain the token is a legacy method,
cli/cli#2157 which was replaced with
`gh auth token` command, cli/cli#6324

…ieren (#1)

* Pull the n8n image instead of building it on `up`

The n8n service declared both `image:` and `build:`. With no local image —
the normal state after a fresh clone — Compose builds instead of pulling,
contradicting the README and forcing every participant through a build they
do not need. The build fetches curl/jq from the Alpine package repos and
fails behind TLS-inspecting proxies with `certificate verify failed`.

Drop the `build:` block so `up` pulls the prebuilt image (which already
contains the connector). Verified on Compose V1 and V2. `pull_policy: always`
was not an option: V1 accepts the key but ignores it at runtime.

`make build` keeps the local build path and now calls `docker build`
directly, the same way scripts/publish-image.sh already does — it never
needed the compose build.

Also drop `-p c2g`: it put `make` targets on a different Compose project
than the README's `docker compose` commands, so `make down`/`make clean`
silently no-oped on a stack started per the README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* Fix GHCR login docs and workflow node counts

`gh auth token` only exists since gh 2.17 (cli/cli#6324). Older versions —
Ubuntu still ships 2.4.0 — pipe their error message into `docker login`,
which takes it as the password and reports `denied`. That looks like a
permissions problem, so the old note sent readers to the challenge owner
even when their access was fine. State the version requirement, point to
the PAT path as the way out, and check gh's version before org access.

Derive the username via `gh api user --jq .login` so the DEIN-GITHUB-USER
placeholder cannot be copied verbatim, and so the command cannot silently
target the wrong account.

Node counts were wrong and counted inconsistently: WF1 (8) included its
sticky note, WF3 (8) did not, WF2 (11) matched neither. Report functional
nodes plus sticky notes separately.

The images section no longer claims `up` pulls "by default" — it now does,
as of the previous commit — and says outright that the build path is not
needed for the challenge.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>