Replace push-protected with direct push via TEAM4-0 bypass (#721)

Replace push-protected with direct push via TEAM4-0 bypass

The push-protected action relies on CI running on the push-action/**
temp branch to satisfy required status checks before pushing to master.
GitHub no longer triggers workflows for pushes made from within a
running workflow, so the temp branch CI never runs, push-protected
declares all checks vacuously complete, and the push fails.

Instead, a repository ruleset now enforces required status checks on
master with TEAM4-0 as an explicit bypass actor. The checkout step uses
RELEASE_PAT so the persisted credential is already TEAM4-0's token,
and the CD workflow pushes directly via git push — no remote URL
manipulation needed.

Also removes the dead push-action/** trigger from ci_tests.yml, which
only existed to support push-protected's temp branches.

Author: CasperWA

.github/workflows/cd_release.yml

@@ -27,6 +27,7 @@ jobs:
       uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        token: ${{ secrets.RELEASE_PAT }}
 
     - name: Set up git config
       run: |
@@ -74,13 +75,7 @@ jobs:
 
     - name: Update '${{ env.DEFAULT_REPO_BRANCH }}'
       if: steps.update_version_step.outputs.continue_workflow == 'true'
-      uses: CasperWA/push-protected@v2
-      with:
-        token: ${{ secrets.RELEASE_PAT }}
-        branch: ${{ env.DEFAULT_REPO_BRANCH }}
-        pre_sleep: 15
-        force: false
-        unprotect_reviews: true
+      run: git push origin ${{ env.DEFAULT_REPO_BRANCH }}
 
   publish_container_image:
     name: Publish Container image on GH Packages

.github/workflows/ci_tests.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches:
       - 'master'
-      - 'push-action/**'  # Allow pushing to protected branches (using CasperWA/push-protected)
 
 jobs:
   pre-commit_audit: