fix: authenticate the metadata-update PR as the bot account, not GITHUB_TOKEN

[twcclegg]

Changes

• GitHub now requires a maintainer to click "Approve and run" on workflow runs triggered by PRs opened with the repository's own GITHUB_TOKEN (a June 2026 platform change) — confirmed against real runs on the v9.0.38 metadata PR, which sat in action_required for all 5 required checks despite the PR being entirely automation-authored. That blocks unattended auto-merge, defeating the point of the PR+auto-merge rework.
• Fine-grained PATs can't be scoped to a repo the token's own account only collaborates on (doesn't own) — a documented GitHub limitation, not a configuration issue — so this switches create_new_release_on_new_metadata_update.yml to a classic PAT (BOT_ACCESS_TOKEN secret, public_repo scope) generated from a dedicated libphonenumber-csharp-bot account. Both actions/checkout's token and the script's GITHUB_TOKEN env var now use that secret, so the push and the PR authenticate as the bot account instead of github-actions[bot].
• The job's own permissions: block drops back to the file-level contents: read default — nothing in the job writes via the default GITHUB_TOKEN anymore, so there's no reason to mint an elevated one.
• finalize_metadata_release.yml's trigger condition checked github.event.pull_request.user.login == 'github-actions[bot]' as an anti-spoofing guard (only that identity should be able to trigger a release). Updated to 'libphonenumber-csharp-bot' — without this the workflow would silently stop firing once the PR's author identity changed, and metadata PRs would merge but never get tagged/released/published.
• README.md's "Metadata updates" section notes the bot identity and why.

Testing

• shellcheck -x -S warning on all three lib/*.sh scripts (unchanged in this PR, re-checked for safety) — clean.
• YAML-parsed both modified workflow files.
• Reviewed the diff for any other reference to github-actions[bot] or GITHUB_TOKEN in this flow that would need updating alongside — finalize_metadata_release.yml's own GITHUB_TOKEN usage (for creating the release and dispatching the NuGet publish) is intentionally left as the default token, since that workflow triggers on pull_request: closed rather than opening a PR itself, so it was never subject to the approval gate.

Requires the BOT_ACCESS_TOKEN repository secret to already exist (it does) and the libphonenumber-csharp-bot account to have write collaborator access (it does).

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.26%. Comparing base (08e3851) to head (1c1e895).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #434   +/-   ##
=======================================
  Coverage   87.26%   87.26%           
=======================================
  Files          41       41           
  Lines        3831     3831           
  Branches      978      978           
=======================================
  Hits         3343     3343           
  Misses        284      284           
  Partials      204      204           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.