ci(release): carry the finalize fixes onto the 1.6 line - #3530

Why

release-1.6 was created at v1.6.0's merge commit on 2026-07-22, and the finalize fixes landed on main after that. Workflow files run from the ref they fire on, so a promote PR based on release-1.6 runs this copy of pull-requests-release.yaml, not main's. Shipping v1.6.1 from this line today would repeat two defects v1.6.0 already hit.

What this carries

Three upstream commits, after which this file is byte-identical to main's copy — so later backports touching it will not conflict.

persist-credentials

Without it the checkout persists GITHUB_TOKEN as an http.extraheader, which silently wins over the app token injected by git remote set-url. The stable tag then pushes as GITHUB_TOKEN, which creates no workflow run, so tags.yaml never fires and its generate-changelog and update-website-docs backstops stay silent. That is exactly what happened to v1.6.0.

Changelog as release body

Without it the release publishes with the draft's own body, "Promoted from vX.Y.Z-rc.N".

These two compound into a permanent defect on a maintenance line. A patch's changelog is committed to release-1.6.1, merged into release-1.6, and never reaches main — and update-releasenotes.yaml only watches main, so nothing would ever sync it. The tag-time backstop that would have ported it is dead because of the credential bug. v1.6.1 would ship with placeholder release notes permanently, with no error anywhere.

paths-ignore

Latent rather than active. A promote PR carrying only docs/changelogs/vX.Y.Z.md would be dropped by the filter, producing no finalize run, no tag and no error. v1.6.1 will carry tag-string rewrites so it would not have fired, but the filter has no remaining purpose now that the promote PR always carries a changelog.

On the cherry-pick policy

docs/release.md's skip rule says CI-only changes do not belong in a patch. That rule governs release contents; backporting release machinery so the line is releasable at all is a different thing, and there is precedent already on this branch — #3473, #3474 and #3514 are all CI/release backports.

Verification

actionlint clean. zizmor clean, no findings. YAML parses. No bats suite references this workflow, and hack/promote-gate-contract.bats does not exist on this line, so there is no stale contract test to trip. The diff against origin/main's copy of the file is empty.

Not included

Three known gaps on this line are deliberately out of scope, none of which needs a code change to ship v1.6.1:

• e2e-tag.yaml is absent and tags.yaml has no rc-e2e job, so no E2E runs on the rc. Handled by dispatching E2E Release Tag from main against the published rc tag, which also supplies the promote gate's alternate evidence.
• pull-requests.yaml has no labeled trigger, so adding full-e2e to the promote PR starts nothing. Backporting that needs the label-event guards too, and rc-time validation makes it unnecessary here.
• finalize is still the pre-ci(release): make the registry promotion a re-runnable job #3456 monolith, so a mid-registry failure is not re-runnable and needs the documented hand recovery.

NONE