chore(ci): use bot user to open registry PRs

Author: streamer45

.github/workflows/marketplace-build.yml

@@ -28,6 +28,8 @@ on:
         required: true
       REGISTRY_GPG_KEY_ID:
         required: true
+      REGISTRY_PR_TOKEN:
+        required: false
 
 env:
   CARGO_TERM_COLOR: always
@@ -221,6 +223,7 @@ jobs:
       - name: Create pull request
         uses: peter-evans/create-pull-request@v6
         with:
+          token: ${{ secrets.REGISTRY_PR_TOKEN || github.token }}
           author: "StreamKit Registry Bot <registry-bot@streamkit.dev>"
           committer: "StreamKit Registry Bot <registry-bot@streamkit.dev>"
           branch: "registry/${{ env.RELEASE_TAG }}-${{ github.run_id }}"

RELEASING.md

@@ -69,6 +69,9 @@ Registry PR commits are signed by the workflow. Add these secrets:
 - `REGISTRY_GPG_PASSPHRASE`: passphrase for the private key
 - `REGISTRY_GPG_KEY_ID`: GPG key fingerprint for the registry bot
 
+If you want CI checks to run on the registry PR, add a fine-grained PAT for the
+bot as `REGISTRY_PR_TOKEN` with `contents: write` and `pull-requests: write`.
+
 ### Verify outputs
 
 - GitHub Release includes `*-bundle.tar.zst` assets.