fix(ci): unstick the lockfile refresh PR's required checks

The lockfile-policy design lets manifest-only PRs merge green against a
regenerated lockfile artifact, with refresh-lockfile.yml expected to
land the real lockfile right after via an auto-merge PR. That last step
was permanently stuck: the branch is pushed with the default
GITHUB_TOKEN, which triggers no pull_request workflows, so the required
checks never start, auto-merge never fires, and every frozen-lockfile
install on master fails until a human notices and pokes the PR — which
is exactly what happened after #12095/#12100 merged.

Prefer a LOCKFILE_BOT_TOKEN secret (fine-grained PAT, contents +
pull-requests write) on every credential surface so the push triggers
checks and auto-merge completes unattended, and add a verification step
that fails the refresh run loudly — with recovery instructions in the
job summary — whenever the PR's required checks have not started. A
wiring test pins both properties and the policy job runs it.

Tested: node --test scripts/__tests__/refresh-lockfile-workflow.test.mjs
(3 pass); both workflow files re-parsed as YAML.

scripts/__tests__/refresh-lockfile-workflow.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+const workflow = readFileSync(
+  path.join(repoRoot, ".github/workflows/refresh-lockfile.yml"),
+  "utf8"
+);
+
+test("lockfile refresh pushes and manages its PR with a workflow-triggering credential", () => {
+  // A push made with the default GITHUB_TOKEN triggers no pull_request
+  // workflows, so the lockfile PR's required checks never start and
+  // auto-merge waits forever while master's frozen installs keep failing.
+  // Every credential surface must prefer the bot PAT and fall back to the
+  // default token.
+  const coalesce = /\$\{\{ secrets\.LOCKFILE_BOT_TOKEN \|\| github\.token \}\}/g;
+  const occurrences = workflow.match(coalesce) ?? [];
+  assert.ok(
+    occurrences.length >= 4,
+    `expected the LOCKFILE_BOT_TOKEN fallback on checkout, PR upsert, auto-merge, and verification (found ${occurrences.length})`
+  );
+  assert.doesNotMatch(
+    workflow,
+    /GH_TOKEN: \$\{\{ github\.token \}\}/,
+    "no credential surface may use the bare default token"
+  );
+});
+
+test("a lockfile PR whose required checks never start fails the run loudly", () => {
+  assert.match(workflow, /Verify required checks started on the lockfile PR/);
+  assert.match(workflow, /check-runs/);
+  assert.match(
+    workflow,
+    /::error::Lockfile PR has no required checks running/,
+    "the stuck state must surface as a red run with recovery guidance"
+  );
+});
+
+test("auto-merge remains enabled so a green refresh lands without a human", () => {
+  assert.match(workflow, /gh pr merge --auto --squash --delete-branch/);
+});