fix: handle protected branch in promote-to-stable workflow

- Add PAT_TOKEN support for bypassing branch protection
- Fallback to creating PR if direct push fails
- Add proper permissions for workflow actions

.github/workflows/promote-to-stable.yml

@@ -19,13 +19,15 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      actions: write
     
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
+          persist-credentials: true
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -73,8 +75,8 @@ jobs:
               ;;
           esac
           
-          # Check if calculated version already exists on NPM and increment if necessary
-          while npm view bmad-method@$NEW_VERSION version >/dev/null 2>&1; do
+          # Check if calculated version already exists (either as NPM package or git tag)
+          while npm view bmad-method@$NEW_VERSION version >/dev/null 2>&1 || git ls-remote --tags origin | grep -q "refs/tags/v$NEW_VERSION"; do
             echo "Version $NEW_VERSION already exists, incrementing..."
             IFS='.' read -ra NEW_VERSION_PARTS <<< "$NEW_VERSION"
             NEW_MAJOR=${NEW_VERSION_PARTS[0]}
@@ -115,12 +117,36 @@ jobs:
 
       - name: Create and push stable tag
         run: |
+          # Create new tag (version check already ensures it doesn't exist)
           git tag -a "v${{ steps.version.outputs.new_version }}" -m "Stable release v${{ steps.version.outputs.new_version }}"
+          
+          # Push the new tag
           git push origin "v${{ steps.version.outputs.new_version }}"
 
       - name: Push changes to main
         run: |
-          git push origin HEAD:main
+          # Try direct push first (works if user has PAT_TOKEN with admin rights)
+          if git push origin HEAD:main 2>/dev/null; then
+            echo "✅ Successfully pushed to main branch"
+          else
+            echo "⚠️ Direct push failed (protected branch). Creating a pull request instead..."
+            
+            # Create a new branch for the changes
+            BRANCH_NAME="auto/promote-stable-${{ steps.version.outputs.new_version }}"
+            git checkout -b "$BRANCH_NAME"
+            git push -u origin "$BRANCH_NAME"
+            
+            # Create PR using GitHub CLI
+            gh pr create \
+              --title "🚀 Auto: Promote to stable v${{ steps.version.outputs.new_version }}" \
+              --body "Automated promotion to stable version ${{ steps.version.outputs.new_version }}" \
+              --base main \
+              --head "$BRANCH_NAME"
+            
+            echo "📝 Pull request created for stable promotion"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Publish to NPM with stable tag
         env: