ci: use PUSH_TOKEN for docgen push to bypass branch rules

Problem: the docgen workflow pushes to main using GITHUB_TOKEN, which
authenticates as github-actions[bot]. The bot cannot bypass repository
rulesets on personal repos, so the push is rejected by required PR,
status check, and signature rules.

Solution: prefer a PUSH_TOKEN secret (a PAT authenticated as the repo
admin, who has bypass permissions) with fallback to GITHUB_TOKEN so
the workflow does not break before the secret is created.

.github/workflows/tests.yml

@@ -87,7 +87,7 @@ jobs:
       - name: Commit changes
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PUSH_TOKEN || secrets.GITHUB_TOKEN }}
           COMMIT_MSG: |
             [docgen] Update docs
             skip-checks: true