ci(sync): open registry-sync PRs with a token that triggers checks

sync.yml passes secrets.SYNC_PR_TOKEN (falling back to github.token) to
create-pull-request, because PRs created with the default GITHUB_TOKEN
never start pull_request workflows and so could never satisfy the
required checks. Commits are signed off for DCO. The workflows README
documents the secret and the close/reopen fallback, and the PR body lists
everything the sync now regenerates.

Closes #120

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: TMHSDigital <154358121+TMHSDigital@users.noreply.github.com>

Author: TMHSDigital

.github/workflows/README.md

@@ -119,3 +119,4 @@ When a third-party action releases a new version:
 - `release-drafter/release-drafter` in `release-drafter.yml` is SHA-pinned (v7.10.0). It runs under `pull_request_target` but never checks out PR code. Dependabot proposes SHA bumps.
 - Both conventions above are enforced by `tests/test_workflow_hygiene.py` (workflows) and `tests/test_composite_action_shape.py` (composite actions).
 - `peter-evans/create-pull-request` in `sync.yml` is SHA-pinned. Update as releases land.
+- `sync.yml` opens its PR with `secrets.SYNC_PR_TOKEN` when set. GitHub does not start `pull_request` workflows for PRs created with the default `GITHUB_TOKEN`, so without that secret the required checks never run on the sync PR. Fallback: close and reopen the PR (or push an empty commit to `chore/registry-sync`) to trigger them. To enable, add a fine-grained PAT scoped to this repo with Contents and Pull requests read/write as the `SYNC_PR_TOKEN` Actions secret.

.github/workflows/sync.yml

@@ -43,6 +43,13 @@ jobs:
         if: steps.drift.outputs.changed == 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
+          # PRs opened with the default GITHUB_TOKEN do not trigger
+          # pull_request workflows, so the required checks would never run.
+          # SYNC_PR_TOKEN (a fine-grained PAT or GitHub App token with
+          # contents and pull-requests write) avoids that. Without it the
+          # PR still opens; close and reopen it to start the checks.
+          token: ${{ secrets.SYNC_PR_TOKEN || github.token }}
+          signoff: true
           branch: chore/registry-sync
           delete-branch: true
           commit-message: "chore: sync derived artifacts from registry"
@@ -53,7 +60,8 @@ jobs:
             Regenerated:
             - `README.md` tools table, descriptions, and stats
             - `CLAUDE.md` cataloged tools table and totals
-            - `docs/index.html` embedded registry block
+            - `docs/index.html` embedded registry, cards, filters, and stats
+            - `docs/search-index.json`, `docs/sitemap.xml`, `docs/robots.txt`
 
             Review the diff for accuracy. About section on GitHub is not updated by this workflow; the maintainer runs `python scripts/sync_from_registry.py --about` locally and pipes to `gh repo edit`.
           labels: registry,automated