ci: fix release publish not triggering after Release PR merge

Pushes whose commits originate from the default GITHUB_TOKEN do not
trigger downstream workflow runs, so merging the changesets Release PR
never ran the publish step (the version bump landed on main but the
package was never published to npm).

- Use RELEASE_GITHUB_TOKEN (PAT) for checkout + changesets action, with
  a fallback to GITHUB_TOKEN so behaviour is unchanged until the secret
  is added. Once set, merging the Release PR cascades into publish.
- Add workflow_dispatch as a manual safety valve to re-run publish for a
  version that was bumped but never published.

Author: AlemTuzlak

.github/workflows/publish.yaml

@@ -4,6 +4,10 @@ on:
   push:
     branches:
       - main
+  # Manual safety valve: lets us re-run the publish step on demand (e.g. when a
+  # release got version-bumped but never published). workflow_dispatch is exempt
+  # from the GITHUB_TOKEN "no recursive runs" rule, so it always triggers.
+  workflow_dispatch:
 
 jobs:
   release:
@@ -17,6 +21,12 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v3
+        with:
+          # Use a PAT (falls back to GITHUB_TOKEN if unset) so the changesets
+          # "Release PR" commits are attributed to a real token. Pushes made with
+          # the default GITHUB_TOKEN do NOT trigger downstream workflow runs, which
+          # is why merging the Release PR previously never ran the publish step.
+          token: ${{ secrets.RELEASE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
@@ -38,7 +48,7 @@ jobs:
         id: changesets
         uses: changesets/action@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         with:
           title: "🚀 Release PR"