fix: use PR_TOKEN for tag-scan workflow

[EmersonFras]

Summary

The weekly tag scan workflow was failing to open PRs due to org-level restrictions on GITHUB_TOKEN that prevent it from creating pull requests. Replaced GITHUB_TOKEN with a fine-grained PAT (PR_TOKEN) for the checkout and gh CLI steps, which covers both the git push and gh pr create calls.

Testing

Verified working by running workflow on this branch

[Copilot]

Pull request overview

Updates the weekly tag scan GitHub Actions workflow to use a fine-grained PAT (PR_TOKEN) for operations that need to push branches and open/edit PRs, addressing org-level restrictions that prevent GITHUB_TOKEN from creating pull requests.

Changes:

• Switch actions/checkout authentication from secrets.GITHUB_TOKEN to secrets.PR_TOKEN.
• Switch gh CLI authentication from secrets.GITHUB_TOKEN to secrets.PR_TOKEN for PR creation/editing.
• Preserve working-tree changes when checking out an existing tag-scan/auto branch via git stash/git stash pop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[egrace479]

One note/question on the secret change for the checkout step

[egrace479]

LGTM!