ci: keep the station copies in the commit that changes them

station.csv and station.json are generated from their -dev files. The
bot did that after a merge, pushing a "chore: update station.csv from
station-dev.csv" commit straight to main with CI skipped, so every
station fix landed as two commits: 95 of the last 300 on main were the
bot's.

Do it inside the pull request instead. When a same-repository pull
request opens or moves, the bot reruns both generators in each of its
commits, amends any copy that changed into that commit (author kept,
committer github-actions[bot]) and pushes the branch back with a lease
on the head it saw. The push goes out with PAT_TOKEN, because commits
pushed with GITHUB_TOKEN start no workflow run and the required checks
would never report. A rebase merge then lands one commit per change.

A copy is still never written by hand, and that is now enforced before
a merge instead of reverted after one. station-csv-check and
station-json-check fail any pull request whose copy differs from what
the generator makes of its -dev file. A pull request that leaves the
copy alone passes even if it is stale: a fork gets no secrets, so the
bot cannot push to it, and its copies are generated on main after the
merge as before. On main, a copy that does not match is regenerated
and pushed, which covers a direct push by a ruleset bypass actor.

That replaces protect-station-*.yml, which let a hand edit merge and
then force-pushed a revert to main, judging commits by author name and
email: any GitHub noreply address passed, and a push with CI skipped in
its message never ran it at all.

All four workflows become one, so the two jobs cannot race to push to
main. station-csv-check and station-json-check keep their names, which
the ruleset requires, and pass a pull request that does not touch the
-dev file or the copy, as before.

Author: whes1015