ci: push release + screenshot commits via admin PAT to satisfy branch protection (#25)

main now requires the CLA Assistant check, which only runs on PRs — so the
release bump (ci.yml) and the screenshots job, which push directly to main as
github-actions[bot], were rejected. Check out with RELEASE_TOKEN (a fine-grained
admin PAT) so the push bypasses protection (enforce_admins is off), and mark the
release commit [skip ci] so the PAT-identity push doesn't re-trigger CI and
double-publish.

Requires a new repo secret RELEASE_TOKEN: fine-grained PAT, dev-coach only,
Contents: Read and write.

Author: UltimaPhoenix

.github/workflows/ci.yml

@@ -113,6 +113,12 @@ jobs:
       version: ${{ steps.bump.outputs.version }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          # Admin PAT (fine-grained, dev-coach only, Contents: RW) so the push to the
+          # protected main branch bypasses branch protection (enforce_admins is off).
+          # The default GITHUB_TOKEN runs as github-actions[bot], which is not an admin
+          # and would be rejected by the required CLA check.
+          token: ${{ secrets.RELEASE_TOKEN }}
       - uses: actions/setup-node@v6
         with:
           node-version-file: .node-version
@@ -131,7 +137,10 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add package.json package-lock.json mcpb/manifest.json \
             plugin/.claude-plugin/plugin.json plugin/skills/devcoach/SKILL.md plugin/package.json
-          git commit -m "chore: release v${NEW}"
+          # [skip ci] so neither the main push nor the tag push (both made with a real
+          # PAT identity, which DOES re-trigger workflows) starts a second run that would
+          # double-publish. Publish/release still run in THIS workflow_dispatch run via needs.bump.
+          git commit -m "chore: release v${NEW} [skip ci]"
           git tag "v${NEW}"
           git push origin HEAD:main "v${NEW}"
           echo "version=${NEW}" >> "$GITHUB_OUTPUT"

.github/workflows/update-screenshots.yml

@@ -11,6 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # Admin PAT so the screenshots commit can push to the protected main branch
+          # (the default GITHUB_TOKEN bot is blocked by the required CLA check). The
+          # commit message already carries [skip ci], so this push doesn't re-trigger CI.
+          token: ${{ secrets.RELEASE_TOKEN }}
       - uses: actions/setup-node@v6
         with:
           node-version-file: .node-version