Fix CD release: use new commit instead of force-push to update master (#719)

Fix cd_release.yml: use a new commit and non-force push

Branch protection on master has allow_force_pushes: false. The workflow
was amending the last commit then force-pushing via push-protected,
causing all CD runs to fail since ~December 2025.

Fix by creating a plain new commit (fast-forward) and setting force: false
in push-protected. Also update the deprecated sleep input to pre_sleep
and enable unprotect_reviews: true to temporarily lift the PR-review
requirement during the push. Add note to avoid cito the bot commit message
so the version-bump commit does not trigger redundant workflow runs.

Author: CasperWA

.github/workflows/cd_release.yml

@@ -70,17 +70,17 @@ jobs:
       if: steps.update_version_step.outputs.continue_workflow == 'true'
       run: |
         git add app/__init__.py CHANGELOG.md
-        git commit --amend -C HEAD
+        git commit -m "[bot] Update version and CHANGELOG [skip ci]"
 
     - name: Update '${{ env.DEFAULT_REPO_BRANCH }}'
       if: steps.update_version_step.outputs.continue_workflow == 'true'
       uses: CasperWA/push-protected@v2
       with:
         token: ${{ secrets.RELEASE_PAT }}
         branch: ${{ env.DEFAULT_REPO_BRANCH }}
-        sleep: 15
-        force: true
-        unprotect_reviews: false
+        pre_sleep: 15
+        force: false
+        unprotect_reviews: true
 
   publish_container_image:
     name: Publish Container image on GH Packages

.gitignore

@@ -570,3 +570,5 @@ MigrationBackup/
 constraints.txt
 
 .*_cache/
+
+.claude/