fix(ci-cd): fix env var name mismatch in PAT push command

[tyler-dane]

Problem

bump-and-tag.yml declared the PAT as env var COMPASS_PAT but the push command referenced ${COMPASS_CI_TOKEN} — the secret name, not the shell variable name. The push silently fell back to the default GITHUB_TOKEN, which GitHub blocks from triggering downstream workflows.

Fix

Changed the push command to use ${COMPASS_PAT} to match the env: declaration.

Before:

git push "https://x-access-token:${COMPASS_CI_TOKEN}@github.com/..." "$NEW_TAG"

After:

git push "https://x-access-token:${COMPASS_PAT}@github.com/..." "$NEW_TAG"

Also updates docs/CI-CD/workflows.md to point to the explanation section for COMPASS_CI_TOKEN.

🤖 Generated with Claude Code