Use PAT for changeset release PR updates

[corwinm]

Summary

• update the release workflow to use RELEASE_GITHUB_TOKEN when creating/updating changeset release PRs
• disable persisted checkout credentials so git operations do not fall back to the default GITHUB_TOKEN
• document the required secret and permissions in the README

Why

Release PRs created or updated with the default GITHUB_TOKEN do not trigger downstream push/pull_request workflows, which leaves required CI checks missing on changeset-release/* PRs.

Testing

• npm run ci