ci: replace RELEASE_PAT with GITHUB_TOKEN in bump workflow, add concurrency and dispatch-based release trigger

[Copilot]

bump.yml depended on secrets.RELEASE_PAT to push tags and trigger release.yml. A missing or expired PAT silently breaks the entire bump→release pipeline.

Changes

bump.yml

• Remove PAT dependency — all steps now use the built-in github.token (contents: write + actions: write permissions)
• Replace tag-re-push retrigger with gh workflow run — GITHUB_TOKEN tag pushes don't fire push: tags workflow triggers by design; workflow_dispatch API calls do

  - name: Trigger Release workflow
    if: steps.bump.outputs.tag != ''
    env:
      GH_TOKEN: ${{ github.token }}
    run: |
      gh workflow run release.yml \
        --repo "${{ github.repository }}" \
        --ref Main \
        --field "tag=${{ steps.bump.outputs.tag }}"

• Capture new tag as step output — id: bump + $GITHUB_OUTPUT feeds the dispatch step in both the "new bump" and "retrigger failed release" branches
• Add concurrency group (cancel-in-progress: false) — serialises runs when multiple PRs merge in quick succession; a queued run correctly finds nothing to do after the preceding run has already bumped

release.yml

No changes — workflow_dispatch with inputs.tag was already present and handles checkout at the specified tag.

AGENTS.md

Updated CI/CD pipeline docs to reflect no-PAT approach, concurrency protection, and dispatch-based trigger mechanism.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.