Give the tests an AliEn token from the runner host

This lets the AnalysisQC execution reach alice-ccdb.cern.ch, which DPL's CCDB
backend refuses to do without a token.

- JALIEN_TOKEN_CERT and JALIEN_TOKEN_KEY point at a short-lived token that a
  root-owned timer mints on the host from a service certificate.
- The certificate is never readable by the runner account, only the token.
- A new step fails with a clear message when the token is missing or about to
  expire, instead of letting a DPL device abort mid-workflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sawenzel

.github/workflows/sim-tests.yml

@@ -93,6 +93,28 @@ jobs:
             exit 1
           }
 
+      - name: Check the AliEn token
+        if: steps.gate.outputs.skip != 'true'
+        env:
+          JALIEN_TOKEN_CERT: /run/alien-ci/tokencert.pem
+          JALIEN_TOKEN_KEY: /run/alien-ci/tokenkey.pem
+        run: |
+          set -eu
+          # DPL's CCDB backend refuses to talk to alice-ccdb.cern.ch without a
+          # token and aborts the whole device, so check up front rather than
+          # letting it surface as a confusing task crash deep in a workflow.
+          for f in "$JALIEN_TOKEN_CERT" "$JALIEN_TOKEN_KEY" ; do
+            test -r "$f" || {
+              echo "::error title=No AliEn token::$f is missing or unreadable. On the runner host: systemctl start alien-ci-token.service"
+              exit 1
+            }
+          done
+          if ! openssl x509 -in "$JALIEN_TOKEN_CERT" -noout -checkend 3600 >/dev/null 2>&1 ; then
+            echo "::error title=AliEn token expiring::the token expires within the hour. On the runner host: systemctl start alien-ci-token.service"
+            exit 1
+          fi
+          echo "AliEn token valid until $(openssl x509 -in "$JALIEN_TOKEN_CERT" -noout -enddate | cut -d= -f2)"
+
       - name: Resolve the O2PDPSuite tag
         id: tag
         if: steps.gate.outputs.skip != 'true'
@@ -131,6 +153,13 @@ jobs:
           # matters here: anything readable by this account is readable by the
           # fork-pull-request code that runs as it.
           JALIEN_USER: alien-ci
+          # DPL's CCDB backend needs a GRID token for alice-ccdb.cern.ch. These
+          # are *paths* to a short-lived token minted from a service certificate
+          # by a root-owned timer on the runner host; the certificate itself is
+          # never readable by this account. Verified that paths work — the same
+          # variables also accept PEM content, which is what ali-bot passes.
+          JALIEN_TOKEN_CERT: /run/alien-ci/tokencert.pem
+          JALIEN_TOKEN_KEY: /run/alien-ci/tokenkey.pem
         run: |
           set -eu
           # Everything after "-c" is joined into one string and re-evaluated