feat(coverage-floor): use AUTOMERGE_PAT for seed PR (workflows spawn naturally)

.github/workflows/coverage-floor.yml

@@ -87,10 +87,14 @@ on:
         required: false
         type: string
         default: ""
+    secrets:
+      AUTOMERGE_PAT:
+        description: "PAT used to push the seed branch and open the seed PR so that pull_request workflows actually fire (GITHUB_TOKEN doesn't trigger them — recursion prevention). Already deployed fleet-wide for `claude-author-automerge.yml`. Caller must explicitly forward this secret (see callers/coverage-floor.yml in topcoder1/dotclaude for the syntax). Required for the post-merge seed flow to land without manual unblock."
+        required: false  # absence falls back to GITHUB_TOKEN + warning
 
 permissions:
-  contents: write       # seed-mode self-commit
-  pull-requests: write  # sticky PR comment
+  contents: write       # post-merge seed branch + push
+  pull-requests: write  # sticky PR comment + open seed PR
 
 jobs:
   measure:
@@ -287,7 +291,12 @@ jobs:
           TARGET: ${{ steps.floor.outputs.target }}
           INPUT_FLOOR_FILE: ${{ inputs.floor_file || '.coverage-floor' }}
           SEED_MIN: ${{ inputs.seed_minimum || '1.0' }}
-          GH_TOKEN: ${{ github.token }}
+          # Use AUTOMERGE_PAT if forwarded by the caller; fall back to
+          # GITHUB_TOKEN with a warning (recursion-prevention means seed
+          # PR opened by GITHUB_TOKEN won't spawn pull_request workflows,
+          # so the seed PR will sit "blocked" until a user pushes an
+          # empty commit to its branch).
+          AUTOMERGE_PAT: ${{ secrets.AUTOMERGE_PAT }}
         run: |
           set -euo pipefail
           # Loop-prevention guard: refuse to seed below seed_minimum.
@@ -300,6 +309,19 @@ jobs:
           PROPOSED=$(awk -v m="$MEASURED" 'BEGIN {x = m - 0.5; if (x < 0) x = 0; printf "%.1f", x}')
           TODAY=$(date -u +%Y-%m-%d)
 
+          # Select the auth token. Prefer AUTOMERGE_PAT (the seed PR will
+          # spawn pull_request workflows naturally); fall back to GITHUB_TOKEN
+          # with a warning so the operator knows manual unblock is needed.
+          if [[ -n "${AUTOMERGE_PAT:-}" ]]; then
+            export GH_TOKEN="$AUTOMERGE_PAT"
+            PUSH_URL="https://x-access-token:${AUTOMERGE_PAT}@github.com/${GITHUB_REPOSITORY}.git"
+            echo "==> Using AUTOMERGE_PAT for seed branch push + PR open (workflows will fire naturally)"
+          else
+            export GH_TOKEN="${{ github.token }}"
+            PUSH_URL="origin"
+            echo "::warning::AUTOMERGE_PAT secret not forwarded by caller. Falling back to GITHUB_TOKEN, which won't spawn pull_request workflows on the seed PR. The seed PR will be 'blocked' until someone pushes an empty commit to its branch. See callers/coverage-floor.yml in topcoder1/dotclaude for how to forward the secret."
+          fi
+
           # Ensure the label exists (idempotent).
           gh label create coverage-floor-seed \
             --description "Auto-opened by coverage-floor.yml to seed the floor after install" \
@@ -323,7 +345,7 @@ jobs:
           git add "$INPUT_FLOOR_FILE"
           git commit -m "chore(coverage): seed floor at ${PROPOSED}% (measured ${MEASURED}%)" \
             -m "Auto-seeded post-merge by coverage-floor.yml. After this PR merges, future PRs enforce this floor."
-          git push -u origin "$BRANCH"
+          git push -u "$PUSH_URL" "$BRANCH"
 
           # Open auto-mergeable PR. Single .coverage-floor file change is
           # safe-paths-automerge eligible per the central policy.