fix: make maintainer tool output actionable

--emulator accepts a buildbot core name from a profile's cores:, and a
mistyped target gets the closest names instead of every target. diff_truth
shows destinations and reports unpaired entries as evidence, not removals.
The verify summary counts discrepancies, a shared destination names both
systems, a truth hash conflict names both cores, and pipeline steps carry
their place in the real run instead of N/8. Every GitHub API caller takes
the token from github_token(), which falls back to gh auth token.

scripts/upstream.py

@@ -206,9 +206,13 @@ def _headers(url: str, accept_json: bool = False) -> dict[str, str]:
     headers = {"User-Agent": USER_AGENT}
     if accept_json:
         headers["Accept"] = "application/json"
-    token = os.environ.get("GITHUB_TOKEN", "")
-    if token and urllib.parse.urlsplit(url).netloc in GITHUB_HOSTS:
-        headers["Authorization"] = f"token {token}"
+    if urllib.parse.urlsplit(url).netloc in GITHUB_HOSTS:
+        from common import github_token  # noqa: PLC0415
+
+        # GITHUB_TOKEN, else the one gh is logged in with.
+        token = github_token()
+        if token:
+            headers["Authorization"] = f"token {token}"
     return headers