fix(release): grant actions:write + drop broken auto-merge on tap (#1336)

Two bugs surfaced on the v1.3.26 release:

1. release.yml's new `Trigger Homebrew cask bump` step failed with
   HTTP 403 "Resource not accessible by integration". The publish-release
   job's permissions block only listed `contents: write`, but
   POST /actions/workflows/:id/dispatches requires `actions: write` on the
   scoped-down GITHUB_TOKEN. Added the permission.

2. Even when the bump workflow does run, its `gh pr merge --auto` was
   silently no-op'ing against the homebrew-orca tap, leaving bump PRs
   open. `--auto` only activates when there's a required check or
   branch-protection rule to wait on; the tap intentionally has neither.
   Switched to a direct squash-merge so the tap stays hands-free as
   originally intended.

Co-authored-by: Orca <help@stably.ai>

.github/workflows/homebrew-bump.yml

@@ -150,6 +150,8 @@ jobs:
             --head "$branch" \
             || gh pr edit "$branch" --title "orca $VERSION"
 
-          # Why: auto-merge so the tap stays hands-free. Tap repo must have
-          # "Allow auto-merge" enabled in settings for this to take effect.
-          gh pr merge "$branch" --squash --auto --delete-branch || true
+          # Why: squash-merge immediately rather than --auto. The tap has no
+          # required checks or branch protection, and `gh pr merge --auto`
+          # only activates when there's something to wait on — on a repo
+          # with no gates it silently no-ops, leaving the PR open forever.
+          gh pr merge "$branch" --squash --delete-branch

.github/workflows/release.yml

@@ -222,6 +222,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # Why: actions:write is required for `gh workflow run homebrew-bump.yml`
+      # (below). Without it GITHUB_TOKEN gets HTTP 403 "Resource not accessible
+      # by integration" on POST /actions/workflows/:id/dispatches. The default
+      # scoped-down token grants only what the `permissions:` block lists.
+      actions: write
     steps:
       - name: Publish release
         # Why: derive `--prerelease` from the tag shape (not from whatever