ci: enable 'Allow GitHub Actions to create and approve pull requests' at the org level

[williamzujkowski]

Context

PR #185 migrated the release flow to release-please. The first run failed on this step:

```
##[error]release-please failed: GitHub Actions is not permitted to create or approve pull requests.
```

release-please correctly bumped `package.json` 0.5.7 → 0.6.0, regenerated `CHANGELOG.md`, and pushed the branch `release-please--branches--main--components--openlaw-git-pipeline` — it just couldn't open the PR for it. I opened PR #186 manually to unblock; release-please will recognize and re-manage it on the next push to main.

Attempted to enable the repo-level setting via API and got:

```
{"message":"Conflict","errors":"Write permissions for workflows are disabled by the organization"}
```

The org-level setting at the civic-source org blocks it.

Fix

Org admin needs to:

1. Visit https://github.com/organizations/civic-source/settings/actions
2. Under "Workflow permissions", check "Allow GitHub Actions to create and approve pull requests" (or change Workflow permissions from "Read repository contents" to "Read and write" depending on what's currently set)
3. Then at repo level: https://github.com/civic-source/us-code-tracker/settings/actions — same checkbox

After this, every push to main will autonomously open/update a Release PR via release-please. No more manual `gh pr create` for releases.

Acceptance criteria

• Org setting enabled
• Repo setting enabled
• After the next conventional-commit push to main, release-please opens or updates a Release PR without intervention

[williamzujkowski]

Now failing on every push to main. As of today this is the cause of a red Release Please check on each merge (the run errors with GitHub Actions is not permitted to create or approve pull requests). Several PRs merged today each tripped it, so it's persistent red CI on the default branch, not a one-off — worth prioritizing.

Code-side workaround that avoids the org setting (same pattern as #174's Scorecard PAT): release-please can authenticate with a fine-grained PAT instead of the default GITHUB_TOKEN, which sidesteps the "Actions can't create PRs" restriction entirely:

# .github/workflows/release-please.yml
- uses: googleapis/release-please-action@<pinned>
  with:
    token: ${{ secrets.RELEASE_PLEASE_TOKEN }}   # PAT with contents:write + pull-requests:write

This still needs a human to create the PAT and add it as a repo secret, but it does not require org-admin access to the Actions setting — so it's an unblock path if the org-level toggle is slow. Either route closes this; the org toggle is cleaner long-term.

[williamzujkowski]

Concrete impact update: as of the 2026-06-27 merges, release-please now has a queued v0.6.1 (0.6.0 → 0.6.1) it cannot publish.

The latest release-please.yml run built the candidate release successfully — version bump, changelog, commit, and the release-please--branches--main--components--openlaw-git-pipeline branch ref were all created — and then failed at the final step with:

release-please failed: GitHub Actions is not permitted to create or approve pull requests.

So four merged fixes are now sitting unreleased behind this setting, three of them security fixes:

• fix(fetcher): harden ZIP extraction, title padding, and HTML body cap #220 fetcher hardening (ZIP null-contract, title padding, HTML body cap, decompression-bomb cap)
• fix(transformer): escape YAML frontmatter strings (closes #221) #222 transformer YAML-injection escaping (closes security/correctness: YAML frontmatter injection — section headings with a double-quote produce invalid frontmatter #221)
• fix(annotator): escape all string fields in sidecar YAML serialization #224 annotator sidecar YAML-injection escaping
• fix(annotator): pin sourceUrl to CourtListener origin (#223, finding 1) #225 annotator sourceUrl off-origin link pinning (SSRF/link-spoof)

Resolving this issue (org/repo setting: Settings → Actions → General → "Allow GitHub Actions to create and approve pull requests", or switch release-please to a PAT/GitHub App token) would let the v0.6.1 Release PR open and ship these.