ci: accept optional PAT in shared auto-merge workflow (#81)

* ci: accept optional PAT in shared auto-merge workflow

The shared auto-merge.yaml uses GITHUB_TOKEN to drive gh pr merge --auto.
When auto-merge later squash-merges the PR, the resulting push to main
is authored by github-actions[bot], and per GitHub's recursion-prevention
rule, pushes attributed to GITHUB_TOKEN do not trigger downstream
push-triggered workflows. That has silently broken release-please across
trips-email-ingest-worker, trips-api, and trips-frontend for weeks.

Accept JAI_CI_PERSONAL_ACCESS_TOKEN as an optional workflow_call secret
and use it as GH_TOKEN when provided. Falls back to github.token so
callers without the PAT (e.g. trips umbrella, trips-infra, and any
future consumer that has no release.yaml) continue to work unchanged.

Callers add 'secrets: inherit' in separate PRs.

Fixes #80

* ci: document explicit auto-merge secret forwarding

ci: pass GITHUB_TOKEN to octocov

ci: normalize coverage artifact paths

ci: add reusable octocov coverage workflow