fix: use PAT for publish to trigger workflows on created PRs

[terraboops]

Summary

• Add separate pat secret for the publish job — PRs created with GITHUB_TOKEN don't trigger workflows (GitHub's infinite loop prevention), so required checks never run
• token remains for read-only operations (discover, validate, generate)
• pat is used for PR creation and auto-merge in the publish job
• Bumps version to 1.0.4

Callers update to:

secrets:
  token: ${{ secrets.GITHUB_TOKEN }}
  pat: ${{ secrets.PAT }}

Test plan

• CI passes
• On push to main: publish job creates PR using PAT, workflows trigger on the created PR

🤖 Generated with Claude Code