Wire parity autofix to existing OVVO_SYNC_TOKEN / PARITY_APP_TOKEN secrets

Use the repo's existing GitHub PAT secrets instead of a new
PARITY_DISPATCH_TOKEN: OVVO_SYNC_TOKEN emits the inspect->autofix
repository_dispatch, PARITY_APP_TOKEN opens the fix PR. Document that
ANTHROPIC_API_KEY is a separate Anthropic credential and is still required.

Author: claude

.github/workflows/inspect-r-api-update.yml

@@ -131,7 +131,7 @@ jobs:
         if: steps.payload.outputs.fresh_cache != 'true'
         shell: bash
         env:
-          DISPATCH_TOKEN: ${{ secrets.PARITY_DISPATCH_TOKEN }}
+          DISPATCH_TOKEN: ${{ secrets.OVVO_SYNC_TOKEN }}
         run: |
           set -euo pipefail
           # The cache-based gates below only prove parity against the committed
@@ -143,7 +143,7 @@ jobs:
             exit 0
           fi
           if [ -z "${DISPATCH_TOKEN:-}" ]; then
-            echo "PARITY_DISPATCH_TOKEN not set; skipping auto-chain to parity-autofix."
+            echo "OVVO_SYNC_TOKEN not set; skipping auto-chain to parity-autofix."
             echo "Run parity-autofix manually with r_commit=${{ steps.payload.outputs.r_commit }} r_version=${{ steps.payload.outputs.r_version }}."
             exit 0
           fi

docs/parity_autofix.md

@@ -77,10 +77,18 @@ workflows:
 
 `inspect-r-api-update` chains to `parity-autofix` via a `repository_dispatch`,
 which the default `GITHUB_TOKEN` cannot emit. To enable the automatic chain, add
-a PAT with `contents: write` (or `repo`) scope as the `PARITY_DISPATCH_TOKEN`
-secret. Without it, `inspect-r-api-update` prints the manual trigger command and
-you run `parity-autofix` yourself via **workflow_dispatch** (inputs: `r_commit`,
-`r_version`).
+a fine-grained PAT with **Contents: read and write** on `NNS-python` as the
+`OVVO_SYNC_TOKEN` secret. Without it, `inspect-r-api-update` prints the manual
+trigger command and you run `parity-autofix` yourself via **workflow_dispatch**
+(inputs: `r_commit`, `r_version`).
+
+## Secret summary
+
+| Secret | Kind | Used for | Required? |
+| --- | --- | --- | --- |
+| `ANTHROPIC_API_KEY` | Anthropic key (`sk-ant-…`, from console.anthropic.com) | authenticate the agent to Claude | **yes** — a GitHub token does not work here |
+| `PARITY_APP_TOKEN` | GitHub fine-grained PAT (Contents R/W, Pull requests R/W) | open the fix PR so CI runs on it | recommended |
+| `OVVO_SYNC_TOKEN` | GitHub fine-grained PAT (Contents R/W) | emit the `inspect -> autofix` `repository_dispatch` | optional (manual trigger otherwise) |
 
 ## Model