cmd/plant: avoid token exposing in bot.yml

[demget]

Use the token_env setting instead of token to avoid exposing secrets in the built Docker image.