ci: reference the report action by local path, not a version pin

Point both Report coverage steps at ./.github/actions/report instead of
a pinned CoverageTracker/coverage-tracker/.../report@vX.Y.Z tag. This
repo dogfoods its own action, so it should run the exact code on the
current branch rather than a released version — and a local path never
needs resolving a tag/branch at all, which permanently removes the
catch-22 where release-prep bumped this pin ahead of the tag existing.

Reverts the now-unnecessary release-prepare.yml changes (ci.yml pin
bumping, workflows: write) since there's no longer a pin here to bump.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: tbjers

.github/workflows/ci.yml

@@ -79,7 +79,11 @@ jobs:
           retention-days: 30
 
       - name: Report coverage
-        uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0
+        # Local path, not a pinned release tag: this repo dogfoods its own
+        # action, so it should always run the exact code on this branch/ref
+        # rather than a released version that may lag behind (or, during
+        # release prep, not exist yet as a tag at all).
+        uses: ./.github/actions/report
         with:
           worker-url: https://demo.coveragetracker.dev
           coverage-path: dashboard/coverage/lcov.info
@@ -115,7 +119,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Report coverage
-        uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0
+        uses: ./.github/actions/report
         with:
           worker-url: https://demo.coveragetracker.dev
           category: backend

.github/workflows/release-prepare.yml

@@ -17,10 +17,6 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  # Needed because the release commit touches .github/workflows/ci.yml
-  # (bumping its action-usage pin) — the GitHub API rejects workflow-file
-  # writes from a token without this permission, even with contents: write.
-  workflows: write
 
 concurrency:
   group: release
@@ -82,10 +78,10 @@ jobs:
             (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version)
           done
 
-      - name: Update action-usage pins
+      - name: Update README action-usage pins
         run: |
           sed -i -E "s#(\.github/actions/report@v)[0-9]+\.[0-9]+\.[0-9]+#\1${VERSION}#g" \
-            README.md .github/actions/report/README.md .github/workflows/ci.yml
+            README.md .github/actions/report/README.md
 
       - name: Create release branch
         env:
@@ -104,7 +100,7 @@ jobs:
             package.json package-lock.json \
             dashboard/package.json dashboard/package-lock.json \
             .github/actions/report/package.json .github/actions/report/package-lock.json \
-            CHANGELOG.md README.md .github/actions/report/README.md .github/workflows/ci.yml
+            CHANGELOG.md README.md .github/actions/report/README.md
 
       - name: Open release PR
         env: