fix(ci): authenticate Version Packages pushes as CI user

[frahlg]

Summary:

• make the Version Packages branch push use CI_TOKEN as well as the GitHub API calls
• expose the PAT only after npm install and only for the Changesets step
• restore github.token even when Changesets fails, so stable tag publication keeps its existing event behavior
• fail closed when CI_TOKEN is missing

Root cause:

actions/checkout persisted github.token in the repository extraheader. changesets/action therefore made its API calls with CI_TOKEN but force-pushed with github-actions[bot]. GitHub did not start pull_request workflows for PR #824, so it had no checks.

Checks:

• actionlint 1.7.9
• git diff --check

Coordination:

PR #876 also touches release.yml but is a broad checkout action bump and is not needed for 2.0. Keep it out of the release candidate and rebase it after this release fix lands.