Dockerfile: use actual GH username in classic-PAT URL, not x-access-token

Previous push tried 'https://x-access-token:TOKEN@github.com/...'
(GitHub-Actions placeholder convention). GitHub rejected it:
'Invalid username or token. Password authentication is not supported
for Git operations.' Classic PATs over HTTPS Basic Auth need a real
GitHub username as the user half of the URL, even though the username
is ignored once GitHub validates the PAT as the credential.

Switching to 'https://michaelr27:TOKEN@github.com/...' which is the
form GitHub's docs themselves recommend. Hardcoding 'michaelr27' is
acceptable temporary debt: this whole URL goes away when we either
swap GH_PAT for the read-only deploy key (URL becomes git+ssh://) or
when huggingface/cadgenbench flips Public (URL drops auth entirely).

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -60,15 +60,19 @@ RUN pip install --no-cache-dir playwright \
 # not exposed as env, not written to disk after the layer commits. Bumping
 # CADGENBENCH_SHA is the one-line path to picking up a new cadgenbench.
 ARG CADGENBENCH_SHA=d7e0468
-# URL form `https://x-access-token:<token>@github.com/...` (GitHub Actions
-# convention) rather than the bare `https://<token>@github.com/...` form:
-# the bare form works only for fine-grained PATs (GitHub special-cases the
-# single-value username), while classic PATs need explicit
-# `username:token` Basic Auth or git prompts for a password and fails in
-# the non-interactive container build.
+# URL form `https://<USERNAME>:<TOKEN>@github.com/...` per GitHub's own
+# PAT docs. The bare form `https://<TOKEN>@github.com/...` works only for
+# fine-grained PATs (GitHub special-cases the single-value username), and
+# the GitHub-Actions placeholder `x-access-token` is rejected as a
+# non-existent user. The username here is the actual PAT owner
+# (`michaelr27`); the value is just an HTTP Basic Auth label, GitHub
+# ignores it during auth and uses the PAT as the credential. Hardcoding
+# it is acceptable temporary debt: this whole URL goes away when we swap
+# GH_PAT for a deploy key (URL becomes `git+ssh://`) or when
+# huggingface/cadgenbench flips Public (URL drops auth entirely).
 RUN --mount=type=secret,id=GH_PAT,mode=0400,required=true \
     pip install --no-cache-dir \
-        "cadgenbench @ git+https://x-access-token:$(cat /run/secrets/GH_PAT)@github.com/huggingface/cadgenbench.git@${CADGENBENCH_SHA}"
+        "cadgenbench @ git+https://michaelr27:$(cat /run/secrets/GH_PAT)@github.com/huggingface/cadgenbench.git@${CADGENBENCH_SHA}"
 
 # Drop privileges. HF Spaces conventionally run as uid 1000 with
 # WORKDIR /home/user/app.