Auto-Merge needs a PAT

Without a PAT, push checks are not one on auto-merge, causing certain CI checks not to run (including comparisons), which breaks future PRs.