Summary

• Fix git tag push failure: withGitToken was embedding the token in the remote URL (x-access-token:TOKEN@github.com/...), but newer git credential managers on CI runners intercept the connection and ignore URL-embedded credentials, causing git push --tags to fail with "could not read Username". Now uses http.<server>/.extraheader = Authorization: bearer TOKEN instead — the same mechanism actions/checkout uses, which takes priority over credential managers.
• Remove redundant git push in pushWithTags: The commit push before git push --tags is unnecessary in the publish flow (no new commits to push) and was the command that was actually failing first.
• Recover deleted bump files for GitHub release notes: In the post-version-PR-merge publish flow, bump files are already deleted. ciReleaseCommand now recovers them from the version commit (git diff HEAD~1 HEAD --diff-filter=D) and passes them to publishCommand, so GitHub release bodies are populated with proper changelog content.
• Add extractChangelogEntry helper: Extracts a specific version's entry from a CHANGELOG.md string (for use in release body generation).

Test plan

• Merge a version PR and verify git tags are pushed successfully in CI
• Verify GitHub releases have proper release notes (not empty bodies)
• Verify the recoverDeletedBumpFiles correctly reads bump file content from HEAD~1