ci(release): push release tag with KIT_RELEASE_TOKEN so the release pipeline fires

[BCook98]

Problem

In .github/workflows/release.yml, the release job's actions/checkout step (was line ~16-17) had no token::

- uses: actions/checkout@v4
  with: { fetch-depth: 0 }

So the tag push in scripts/tag-release.sh (~line 24, git push origin "${TAG}") authenticated with the default GITHUB_TOKEN that checkout persists.

GitHub does NOT fire workflow triggers for tags pushed using GITHUB_TOKEN. That means on a real release (when the "Version Packages" PR merges and the changesets publish step pushes vX.Y.Z), the downstream pipeline that the tag is supposed to trigger — GoReleaser binary build, the shellcade-kit Homebrew cask, and the kit-released consumer repository_dispatch notify — silently never ran. The only recovery was a manual workflow_dispatch.

Fix

Persist KIT_RELEASE_TOKEN (a PAT) on the checkout step that precedes the tag push, so git push origin "${TAG}" uses the PAT and the tag push fires the downstream workflows:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
    token: ${{ secrets.KIT_RELEASE_TOKEN }}

The git push in scripts/tag-release.sh runs against the origin remote configured by this same checkout step, so persisting the PAT here is what makes the tag push use it.

Related note (not fixed here — kept this PR focused)

The changesets/action env still uses a silent fallback: GITHUB_TOKEN: ${{ secrets.KIT_RELEASE_TOKEN || secrets.GITHUB_TOKEN }} (release.yml line ~32). With this PR, the checkout token: has no such fallback — if KIT_RELEASE_TOKEN is unset/expired, checkout fails loudly rather than half-publishing, which is the desired behavior for the trigger path. But the changesets-action fallback could still half-publish (open the Version Packages PR / version bump under the Actions token) on an expired PAT while the tag-trigger path is broken. Worth a follow-up to decide whether that fallback should also be made strict. Left out of this PR to keep the diff to the trigger fix.

Verification

• actionlint .github/workflows/release.yml → passed (clean).
• YAML parse (ruby -ryaml) → YAML_OK.

No Go/build changes; this is a workflow-only edit. The end-to-end trigger behavior can only be confirmed on a live release run, which I can't exercise here.

Reviewer focus

• Confirm secrets.KIT_RELEASE_TOKEN is populated in the repo/org and scoped with contents:write so the tag push succeeds.
• Confirm the persisted-credentials path: the publish step's git push origin "${TAG}" uses the credentials this checkout step stores.

🤖 Generated with Claude Code