ci(release): stage the release PR instead of opening it, and move to comlink 4.4.2

[MarTrepodi]

Two things: move the integration services to Comlink 4.4.2, and stop prepare-release from opening the release PR itself.

Comlink 4.4.2

4.4.2 fixes the /data fetch that neither 4.4.0 nor 4.4.1 could complete, so the two /data tests are no longer quarantined — the xfail markers and their now-unused SwgohComlinkException imports are gone, and the tests assert normally again.

Both services move to 4.4.2. The comlink-hmac service had been left on 4.4.1; running the two on different builds means the HMAC tests exercise a different server than the rest of the suite, so the pin comment now says to keep them in step.

prepare-release no longer opens the PR

gh pr create is removed. The workflow now:

1. writes the PR body to .github/release-pr/<tag>.md, including the new version's changelog section extracted from the regenerated CHANGELOG.md;
2. commits that file alongside CHANGELOG.md and pushes release/<tag>;
3. writes a job summary with a prefilled "Open the release PR" link (base main, head release/<tag>, title prefilled), plus the body text inline for copy-paste.

permissions drops to contents: write, and the GH_TOKEN env goes away — nothing calls the API any more.

Why this is better than a bot-opened PR

A PR opened by github-actions[bot] using the default GITHUB_TOKEN does not trigger pull_request workflows. CI, Integration Tests, and Commit Lint all gate on pull_request against main, so the release PR would have arrived with no checks at all. Having a maintainer open it means the full suite runs before main moves.

The body-file tradeoff

The file lives on the release branch, so merging the release PR carries .github/release-pr/<tag>.md into main — over time that accumulates one small markdown file per release. That is a deliberate choice: it makes the PR text a durable, reviewable artifact rather than something that exists only in a job summary that ages out.

If you would rather main stay clean, two alternatives need only a small edit: upload the body as a workflow artifact instead of committing it, or keep the job summary alone. Both drop the permanent record.

🤖 Generated with Claude Code