ci(rk): push to cachix only from rk-ci (#49)

The first day of pushes filled exo-rkllama with 11.3 GB, mostly the
three disjoint platform closures uploaded by pipeline.yml's matrix.
Drop authToken from pipeline.yml and rk-upstream-sync.yml so those
jobs go pull-only (cachix-action never pushes without a token; both
caches are public, so reads are unchanged). rk-ci keeps the token and
remains the single push path, covering the RK-specific devshell and
build closure that fork CI actually re-uses.

Author: jfreed-dev

.github/workflows/pipeline.yml

@@ -36,7 +36,6 @@ jobs:
         with:
           name: exo-rkllama
           extraPullNames: exo
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: Build Metal packages (macOS only)
         if: runner.os == 'macOS'

.github/workflows/rk-upstream-sync.yml

@@ -81,7 +81,6 @@ jobs:
         with:
           name: exo-rkllama
           extraPullNames: exo
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: Gate the merge result
         if: steps.pick.outputs.skip != '1' && steps.drift.outputs.count != '0'