ci(release): add PAT_TOKEN fallback so auto-merge fires today

[vreshch]

Summary

#98 wired RELEASE_PAT as the preferred token with GITHUB_TOKEN fallback. Since RELEASE_PAT is not yet configured, the fallback resolves to GITHUB_TOKEN — the same workflow-suppressing behavior we set out to fix. Auto-merge is still stuck.

Both repos already have an org-level PAT_TOKEN secret (created 2026-01-25). Wire it as the middle-tier fallback: RELEASE_PAT || PAT_TOKEN || GITHUB_TOKEN. Auto-merge starts working today with zero new secrets, and RELEASE_PAT remains the preferred slot for a release-scoped PAT later.

Scope follow-up (nice-to-have, not blocking)

PAT_TOKEN may be broader than a release flow strictly needs. After this lands:

• Create a fine-grained PAT scoped to contents:write + pull_requests:write
• Add as org secret RELEASE_PAT
• Workflow picks it up automatically (first in the fallback chain) — no further code change

Validation

Next release after merge: gh workflow run release-prepare.yml -f bump_type=patch -f packages=core,platform -f auto_merge=true should

1. Push the release branch under PAT_TOKEN credentials
2. Fire pr-validation.yml automatically
3. Auto-merge when validation passes
4. Trigger publish.yml on merge

Paired PR in agentage/cli with the identical change.

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: df4b690e8d5e37cddfba2d6ffa992b5af8537ab1
Branch: ci/pat-token-fallback

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-04-15T20:53:44.058Z