fix: force-with-lease the bump branch so a stale one cannot fail the push

[andychoquette]

What

PushPR in reusable_bump.yml did a plain git push of bump/$NEXT_SEMVER. Switch it to --force-with-lease, and only call gh pr create when there is no open PR for that head.

Why

bump/$NEXT_SEMVER is recreated from $BASE_REF on every run. If a branch for the same version already exists remotely, the two have diverged and the push is rejected non-fast-forward, failing the whole bump.

This is not rare — it happens whenever a release PR is closed unmerged and the bump is re-run after $BASE_REF has moved on. deadline-cloud-for-cinema-4d had a bump/0.12.3 left over from closed PR #560, and every subsequent Bump run failed until the branch was deleted by hand (failing run):

 ! [rejected]        bump/0.12.3 -> bump/0.12.3 (non-fast-forward)
hint: Updates were rejected because the tip of your current branch is behind

Nine other stale bump/* branches are still sitting in that repo (0.5.2, 0.5.4, 0.7.5, 0.7.9, 0.8.0, 0.8.2, 0.8.4, 0.11.0, 0.11.1), each a latent repeat of the same failure. Since this workflow is shared, every caller has the same exposure.

Why force is safe, and why not the alternatives

The bump branch only ever holds the release commit generated by that run, so there is nothing on it to lose.

• --force-with-lease over --force: keeps the protection against a genuinely concurrent push. Checkout's fetch-depth: 0 guarantees the remote-tracking ref the lease compares against.
• Not git push origin --delete first: deleting the remote branch would close any open release PR for it.
• Not repo-level "automatically delete head branches": that only covers merged PRs, and the trigger here is a PR closed unmerged.

Notes

No new permission scopes, so callers need no change — contents: write is already granted by every caller of this workflow.

Untested in CI: this only executes during a real release bump. Validated locally that the workflow still parses as YAML and that the step body passes bash -n.