✨ Use PR Submit for automated PRs

[tiangolo]

Summary

• allow the automated PR workflow to request PR Submit tokens
• replace the long-lived repository secret with a short-lived repository-scoped token obtained through GitHub OIDC
• use read-only checkout credentials and attribute generated commits to pr-submit[bot]

Security

The workflow receives only contents: read and id-token: write. PR Submit validates the allowlisted workflow from the default branch before returning its short-lived installation token with repository contents and pull-request write permissions.

Checks

• parsed the workflow and .github/pr-submit.yml as YAML
• git diff --check

AI Disclaimer

This PR was created with the help of gpt-5.6-sol and reviewed by hand.