feat: optional automerge_pat secret so bot merges trigger push workflows

[topcoder1]

GITHUB_TOKEN-enabled auto-merge produces bot-attributed merge commits, which trigger NO push workflows on the caller repo — no CI, no deploys (GitHub recursion guard; already a banked fleet lesson). On whois-api-llc/wxa-astro this hid a lint break and skipped prod deploys three times in one night once dependabot automerge went live.

This adds an optional automerge_pat secret to the reusable. When the caller maps it, gh pr merge --auto runs under the PAT, the eventual merge commit is attributed to the PAT owner, and the caller's push workflows fire like any human merge. Fallback is unchanged GITHUB_TOKEN behavior — existing callers unaffected. The fetch-metadata step deliberately keeps GITHUB_TOKEN.

Caller-side companion PR: whois-api-llc/wxa-astro (explicit secret mapping — cross-org secrets: inherit is a silent no-op).

Manual merge per repo policy (PRs to ci-workflows are always manual).

🤖 Generated with Claude Code

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

No issues found. Optional PAT fallback (automerge_pat || GITHUB_TOKEN) is correct and backwards-compatible; existing callers unaffected.