GITHUB_TOKEN doesn't have permission to push to fork branches. Use a PAT stored as ACTIONS_UPDATE_TOKEN instead for: - VRT update workflow (checkout and push to contributor forks) - AI-generated release notes (commit files to PR branches)