Context

The Create Release Branch workflow fails at the push step. The Prep branch commit includes an edit to .github/workflows/release-python.yml (the EVERGREEN_PROJECT swap made by create-branch.sh). GitHub rejects the push with GH013: the App token minted by secure-checkout@v3 requests contents:write and pull-requests:write but not workflows permission, so the App cannot push a commit that touches a workflow file. The release App (882883) already has workflows permission granted; the gap is that secure-checkout never requests it in the token.

Definition of done

- .github/workflows/create-release-branch.yml mints an app token that includes workflows: write.
- The Create Release Branch workflow successfully creates and pushes the v4.18 release branch.

Pitfalls

Overwriting GH_TOKEN after checkout is not enough; the push uses the credential configured by actions/checkout, so the checkout token itself must carry workflows permission. Replace the secure-checkout@v3 step with an explicit create-github-app-token@v3 (with permission-workflows: write) followed by actions/checkout@v7 using that token. The release-python.yml workflow may need the same change if it pushes workflow-file edits.