fix(github-token-broker): document invocation contract

[jmgilman]

Summary

• document that the Lambda accepts only empty/null payloads
• make the next broker patch release include the publish workflow and test isolation fixes already merged to master

Validation

• go test ./... in services/github-token-broker
• git diff --check