Prio Notes:

I've changed the authentication method used by the Google account mid June. The account is now using two-factor authentication, and the CI jobs are authenticating using an "application password". This change might have been invisible to the CI job as it only involved changing the value of the "github action secret" which I have done as part of this authentication method change.
If I understand it correctly, using application password makes the CI no longer a "less secure app", so it should allow CI send emails also after Google switches off less-secured-app access.

Okay. I'm going to suggest that this is a "proper solution" for now - it works, and it's not about to be sunset. I heard from @WMDE-leszek that we use Mailgun to send mails from WikibaseCloud. That might be something to consider if we run into reliability / sustainability issues with Google again. But for now, if it ain't broke, let's not fix it any further.

Change #1070905 had a related patch set uploaded (by WMDE-leszek; author: WMDE-leszek):

[mediawiki/extensions/Wikibase@master] secondary CI: Renamed github action secrets used for CI mails

https://gerrit.wikimedia.org/r/1070905

Change #1070906 had a related patch set uploaded (by WMDE-leszek; author: WMDE-leszek):

[mediawiki/extensions/EntitySchema@master] secondary CI: Renamed github action secrets used for CI mails

https://gerrit.wikimedia.org/r/1070906

Change #1070906 merged by jenkins-bot:

[mediawiki/extensions/EntitySchema@master] secondary CI: Renamed github action secrets used for CI mails

https://gerrit.wikimedia.org/r/1070906

Change #1070905 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@master] secondary CI: Renamed github action secrets used for CI mails

https://gerrit.wikimedia.org/r/1070905

I guess for the purposes of tech verification we can just wait until October and then see if email sending still works? (Push a branch to GitHub where .github/workflows/secondaryCI.yml was updated to change the recipient email address and send the email unconditionally, for instance.)

I've confirmed that Entity Schema's weekly "keepalive" emails are being sent. As the mechanism used for "secondary CI" uses the same authentication I claim it is sufficient to call this task completed.