fix(ci): use ACTIONS_PAT for main-release-marker push

[FedeZara]

Summary

The release workflow's main-release-marker step tries git push origin main to land the chore(release): <action>@<version> ledger commit. That push is rejected by main's branch protection:

remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.

Confirmed in run 25934187071 (release of preview@v0.0.1-ci-test). The release itself succeeded — only the ledger commit was dropped, exactly as designed for the "best-effort marker" semantics. But that means <action>/RELEASES.md never gets populated on main, defeating the whole point of having the ledger.

Fix

Mirror fern's release-software.yml pattern: pass an ACTIONS_PAT secret to actions/checkout so subsequent git push calls authenticate as a user/app with branch-protection bypass.

- name: Checkout main
  uses: actions/checkout@v4
  with:
    ref: main
    fetch-depth: 1
    token: ${{ secrets.ACTIONS_PAT || secrets.GITHUB_TOKEN }}

Falls back to GITHUB_TOKEN if ACTIONS_PAT isn't configured — preserves the current "best-effort with warning" behavior for anyone running the workflow without the PAT.

Operator action required

To make the marker step actually push successfully:

1. Generate a fine-grained PAT with Contents: read and write on fern-api/actions, owned by a user/app that's in main's branch-protection bypass allowlist (the same setup fern already uses for ACTIONS_PAT).
2. Add it as ACTIONS_PAT repo secret at Settings → Secrets and variables → Actions.

If you skip this, the workflow keeps working exactly as it does today — releases succeed, marker push fails with a warning, no <action>/RELEASES.md updates land.

Test plan

• actionlint clean
• Local pre-commit hooks (lint + typecheck) pass
• After merge + adding ACTIONS_PAT secret, dispatch a test release (verify-token@v0.0.1-marker-test, prerelease) and confirm:
  • verify-token/RELEASES.md lands on main with the new entry
  • chore(release): verify-token@v0.0.1-marker-test commit shows up in git log main
  • The author of the marker commit is the PAT-owner user, not github-actions[bot]
• If ACTIONS_PAT isn't added, confirm the workflow still completes "success" overall with just the marker-step warning (regression check on the fallback path)