fix(issue-form): pin checkout to develop, serialize runs, simplify release fetch

- `release` events check out the tagged commit, so the script regenerated
  the form from the tag's stale copy and the bot PR could revert form
  edits made on develop since that release - checkout develop explicitly.
- Fixed concurrency group: a release event and the weekly cron no longer
  race on the same ci/update-issue-form branch (queue, no cancel).
- Replace `gh api --paginate` (fetches every release page) with
  `gh release list --exclude-drafts --exclude-pre-releases --limit N`.
- Document the GITHUB_TOKEN limitation on the auto-merge step: bot PRs
  don't trigger required checks; close/reopen kicks them, then auto-merge
  completes after reviews.

scripts/update-issue-form.mjs

@@ -34,16 +34,23 @@ const DRY = process.argv.includes("--dry-run");
 // Matches "0.54.1" and prerelease/beta tags like "0.54.0-beta.1".
 const isVersion = (s) => /^\d+\.\d+/.test(s.trim());
 
-// 1. Fetch published releases (newest first), excluding drafts and prereleases —
-//    those aren't a full release users run, so they don't belong in the dropdown.
+// 1. Fetch the latest published releases (newest first) — drafts and prereleases
+//    aren't a full release users run, so they don't belong in the dropdown.
 const raw = execFileSync(
   "gh",
   [
-    "api",
-    `repos/${REPO}/releases`,
-    "--paginate",
+    "release",
+    "list",
+    "--repo",
+    REPO,
+    "--exclude-drafts",
+    "--exclude-pre-releases",
+    "--limit",
+    String(LIMIT),
+    "--json",
+    "tagName",
     "--jq",
-    ".[] | select(.draft == false and .prerelease == false) | .tag_name",
+    ".[].tagName",
   ],
   { encoding: "utf8" },
 );
@@ -55,7 +62,6 @@ for (const tag of raw.split("\n")) {
   if (!isVersion(ver) || seen.has(ver)) continue;
   seen.add(ver);
   versions.push(ver);
-  if (versions.length >= LIMIT) break;
 }
 
 if (!versions.length) {