ci: Release Please ref update failing on main

[forkwright]

Release Please fails with: 'Error updating ref heads/release-please--branches--main'

Likely same permissions issue as akroasis, or a stale release-please branch that needs pruning.

[forkwright]

Fixed by enabling "Allow GitHub Actions to create and approve pull requests" via repo Actions workflow permissions API (PUT /repos/.../actions/permissions/workflow with can_approve_pull_request_reviews=true). Both workflow permissions (contents: write, pull-requests: write) were already correct — the repo-level setting was the blocker. Release Please ran successfully and opened release PR #107.