fix: make release checkout independent of PAT

[lifeiscontent]

Summary

• validate that RELEASE_TOKEN is configured before the release job attempts checkout
• pass RELEASE_TOKEN to actions/checkout so checkout persists credentials for later git commands
• use a plain git push instead of embedding tokens in the remote URL

Rationale

• actions/checkout documents token persistence as the supported path for authenticated git commands after checkout
• GITHUB_TOKEN pushes do not trigger normal follow-up push workflows, so the release tag push must use RELEASE_TOKEN or another non-GITHUB_TOKEN credential

Validation

• git diff --check
• parsed .github/workflows/ci.yml with Ruby YAML

[Copilot]

Pull request overview

This PR adjusts the git-ops-release workflow so the repository checkout no longer depends on a PAT (RELEASE_TOKEN), and instead uses the default GitHub-provided credentials for checkout while reserving RELEASE_TOKEN (with a GITHUB_TOKEN fallback) for the release push operation.

Changes:

• Remove PAT usage from the actions/checkout step and disable persisted credentials.
• Update the push step to select RELEASE_TOKEN when present, otherwise fall back to GITHUB_TOKEN, and emit a warning when the PAT is missing.
• Push via an authenticated HTTPS URL using the selected token.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.