fix(ci-cd): use PAT to push tag so publish-images.yml is triggered

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tyler-dane

.github/workflows/bump-and-tag.yml

@@ -19,6 +19,8 @@ jobs:
           fetch-depth: 0
 
       - name: Bump patch version and push tag
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
           LATEST=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
           [ -z "$LATEST" ] && LATEST="v0.0.0"
@@ -30,4 +32,6 @@ jobs:
           NEW_TAG="v${MAJOR}.${MINOR}.$((PATCH + 1))"
           echo "Bumping ${LATEST} → ${NEW_TAG}"
           git tag "$NEW_TAG"
-          git push origin "$NEW_TAG"
+          # Push with PAT so the tag event triggers publish-images.yml.
+          # GITHUB_TOKEN pushes are intentionally blocked from triggering downstream workflows.
+          git push "https://x-access-token:${GH_PAT}@github.com/${GITHUB_REPOSITORY}.git" "$NEW_TAG"