fix(ci): enforce release checks

[TaprootFreak]

What & why

Release PRs from develop to main currently skip the API PR workflow. In addition, the automatic release PR is created with GITHUB_TOKEN; GitHub does not trigger downstream pull_request workflows for that creation event.

This change closes both gaps:

• create automatic release PRs with the existing RELEASE_PR_TOKEN secret so their PR workflows start normally
• remove the develop exclusion so release PRs run the same parallel CI as normal PRs
• use the generic visible names Coverage and Run coverage
• reduce the workflow-owned GITHUB_TOKEN pull-request permission to read-only after moving PR creation to the dedicated token

Release PRs therefore run:

• Build and checks
• Coverage
• all three test shards

The coverage command remains the existing Bank Frick-specific test:frick:cov gate and its strict thresholds are unchanged.

Validation

• git diff --check
• Prettier checks for both changed workflow files
• actionlint for both changed workflows (with the three pre-existing SC2086 notices in unchanged lines ignored)
• GitHub Actions checks on every pushed head; the final result is recorded in the PR checks and completion comment
• independent conformance and logic reviews, repeated from scratch after each corrective commit

[TaprootFreak]

Review completed in 3 passes with 0 remaining findings.

• Pass 1 identified and fixed the release-PR trigger gap by using the existing RELEASE_PR_TOKEN for PR creation.
• Pass 2 tightened least-privilege permissions by reducing the workflow-owned GITHUB_TOKEN pull-request access to read-only.
• Pass 3 reviewed the complete final diff from scratch and found no remaining conformance, security, logic, or regression issues.

Final-head CI is fully green with no skipped checks: Build and checks, Coverage, all three test shards, review, and CodeQL/Analyze. The API PR workflow completed in 4m37s; all three test shards started at 19:56:36 UTC, confirming parallel execution.