Use GITHUB_TOKEN instead of ADMIN_PAT in release workflows

[n13]

The release-proposal workflow failed at gh pr create with HTTP 401: Bad credentials (https://github.com/Quantus-Network/qp-zk-circuits/actions/runs/33382620939): the org secret ADMIN_PAT no longer authenticates. Nothing here needs a PAT, so this drops it:

• gh pr create in the release-proposal workflow(s) and gh release create in the tag-and-publish workflow(s) now use the built-in github.token.
• The proposal job gains pull-requests: write (it already had contents: write for the branch push); the publish job already has contents: write, which is all gh release create needs.

Two things to know:

1. The repo setting Settings → Actions → General → "Allow GitHub Actions to create and approve pull requests" must be on, or gh pr create is refused. It is currently off on this repo. Equivalent API call:
   gh api -X PUT repos/Quantus-Network/<repo>/actions/permissions/workflow -f default_workflow_permissions=read -F can_approve_pull_request_reviews=true
2. Pull requests opened with github.token do not trigger pull_request workflows, so the automated release PR will show no CI checks. The tag-and-publish workflow still runs format, build, clippy, doc and audit at the tag before anything is published, and no status checks are required by branch protection.

[n13]

Closing: ADMIN_PAT was rotated instead; the org policy blocks Actions-created PRs and token-created PRs would not trigger CI.