Currently the GHA will set a $TOKENLESS env var and the CLI will read from it.

If there's no token and $TOKENLESS is not set, the CLI will error out. That means you can't use the normal way to override the branch (-B) for tokenless, you need a unique way just for this case. That's kind of counterintuitive.

IMO, we could get rid of the $TOKENLESS env var and make the GHA just use -B, and then change the CLI logic to be:

if not token and ':' not in branch:
    print("nuh-uh")

(Alternatively, we could make the CLI figure out the unprotected branch name on its own)