cc-release-watch — final two fixes

Fix 1 — install the Claude Code CLI

Earlier dispatched runs showed:

cc-triage: extracting features from 2.1.126...
claude exit null:
claude exit null:
cc-triage: 2.1.126 — both attempts failed; sentinel written.

exit null = no claude binary on the runner's PATH. ubuntu-latest doesn't ship with it.

Other claude-using workflows in this repo (claude-health.yml, orchestkit-eval.yml, ultrareview.yml) all do this; this one didn't:

- name: Install Claude Code CLI
  run: npm install -g @anthropic-ai/claude-code@2.1.122 --ignore-scripts

• Pinned to 2.1.122 — matches MIN_CC_VERSION in the matrix, so the cron is reproducible.
• --ignore-scripts blocks postinstall hooks from running with elevated perms.
• Auth is via CLAUDE_CODE_OAUTH_TOKEN env var (already configured at job-level).

Fix 2 — replace direct main push with PR-based snapshot commit

Earlier runs ended with:

[main bf9a9afc] chore(cc-watch): snapshot upstream CHANGELOG
remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.
remote: - 12 of 12 required status checks are expected.
##[error]Process completed with exit code 1.

Branch protection rejects the bot. Replace with the same peter-evans/create-pull-request pattern used by cc-support-window-bump.yml:

- name: Check for snapshot changes
  id: changes
  if: success()
  run: |
    if [ -n "$(git status --porcelain shared/cc-snapshots/ ...)" ]; then
      echo "has_changes=true" >> "$GITHUB_OUTPUT"
    else
      echo "has_changes=false" >> "$GITHUB_OUTPUT"
    fi

- name: Open snapshot PR
  if: success() && steps.changes.outputs.has_changes == 'true'
  uses: peter-evans/create-pull-request@5e914681...  # v7.0.5
  with:
    add-paths: |
      shared/cc-snapshots/
      shared/cc-adoption-gaps.json
      shared/gh-issue-args.json
    commit-message: "chore(cc-watch): snapshot upstream CHANGELOG"
    branch: chore/cc-snapshot-${{ github.run_id }}
    title: "chore(cc-watch): snapshot upstream CHANGELOG"
    labels: automation, cc-adoption

• The "Check for snapshot changes" guard prevents creating empty PRs on no-op cron runs.
• Branch name is keyed by github.run_id so concurrent firings don't collide on a stale branch.
• delete-branch: true cleans up after merge.
• PR is data-only (snapshot files + gap report + milestone title) — safe to auto-merge.

Cost

$0 incremental.

• GHA runner: free (public repo).
• peter-evans action: free.
• npm install: free.
• claude -p --bare calls: bill against your CC subscription cap (already paid for). 8-15 calls/month, well under 1% of any plan.

Verification

1. This PR merges to main.
2. Manual gh workflow run "Claude Release Watch".
3. The dispatched run executes all 6 steps, including the LLM extraction (now finds claude) and the snapshot PR creation (no more 422).
4. An auto-PR appears in the queue with the snapshot data.