ci: use PAT and smart bump/retrigger logic in bump.yml

[MacBuchi]

Changes

• Switch bump.yml to use RELEASE_PAT instead of GITHUB_TOKEN for the checkout step — pushes made with GITHUB_TOKEN do not trigger downstream workflows (GitHub security restriction), so release.yml was never triggered automatically after a tag push.

• Replace the simple cz bump call with a smarter decision tree:

  1. New releasable commits exist → bump version + push tag (normal flow)
  2. No new commits + latest tag has no GitHub Release → re-push the existing tag to retrigger a failed release.yml without counting up the version
  3. No new commits + release already published → exit cleanly (no-op)