ci(release): stop release-please auto-merge loop

The release job deleted the release branch and re-dispatched itself when
the PR had not merged within 60s. Because the PR was authored by
GITHUB_TOKEN its CI never ran (action_required), so it never went green,
auto-merge never fired, and the branch-delete + self-redispatch recreated
the release PR every ~90s indefinitely.

Mirror the working sister-app config: author the PR with RELEASE_PLEASE_TOKEN
so CI runs on it, then just enable native auto-merge. The PAT-authored merge
is a push to main that re-triggers this workflow to cut the release and the
on:push deploy, so the delete/redispatch and explicit deploy dispatch are
no longer needed.

Author: Endika

.github/workflows/release-please.yml

@@ -6,7 +6,6 @@ on:
   workflow_dispatch:
 
 permissions:
-  actions: write
   contents: write
   pull-requests: write
 
@@ -21,40 +20,17 @@ jobs:
       - id: release
         uses: googleapis/release-please-action@v5
         with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
+      # Enable native auto-merge and stop; GitHub rebase-merges once the required
+      # checks pass, and that PAT-authored merge is a push to main that both
+      # re-triggers this workflow to cut the tag/release and triggers the deploy
+      # (on: push), so no explicit deploy dispatch is needed here.
       - if: ${{ steps.release.outputs.pr }}
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           REPO: ${{ github.repository }}
-          WORKFLOW: ${{ github.workflow }}
           PR_JSON: ${{ steps.release.outputs.pr }}
-        run: |
-          PR=$(echo "$PR_JSON" | jq -r .number)
-          BRANCH=$(echo "$PR_JSON" | jq -r .headBranchName)
-          # Rebase-merge works when main has advanced past the release branch's
-          # base. When the release commit already sits directly on main HEAD,
-          # GitHub refuses ("This branch can't be rebased") on a rebase-only
-          # repo — fast-forward main to the release commit via the API instead.
-          gh pr merge --rebase --auto -R "$REPO" "$PR" \
-            || gh pr merge --rebase -R "$REPO" "$PR" \
-            || gh api -X PATCH "repos/$REPO/git/refs/heads/main" \
-                 -f sha="$(gh api "repos/$REPO/git/refs/heads/$BRANCH" --jq .object.sha)"
-          for _ in $(seq 1 30); do
-            STATE=$(gh pr view "$PR" -R "$REPO" --json state --jq .state)
-            [ "$STATE" = "MERGED" ] && break
-            sleep 2
-          done
-          gh api -X DELETE "repos/$REPO/git/refs/heads/$BRANCH" 2>/dev/null || true
-          gh workflow run "$WORKFLOW" -R "$REPO" --ref main
-
-      # When a release is actually published, redeploy from main so the live
-      # build carries the bumped version. release-please's own version-bump
-      # commit is pushed by GITHUB_TOKEN and does NOT trigger the on:push deploy,
-      # so the site would otherwise stay one release behind.
-      - if: ${{ steps.release.outputs.release_created }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: gh workflow run deploy.yml -R "$REPO" --ref main
+        run: gh pr merge --rebase --auto -R "$REPO" "$(echo "$PR_JSON" | jq -r .number)"