Fix metrics workflow protected branch updates (#219)

* fix github metrics workflow for org repo

* fix metrics workflow protected branch updates

* fix metrics workflow review notes

Generated-By: looper 0.3.0 (runner=fixer, agent=openai/gpt-5.5)

.github/workflows/metrics.yml

@@ -13,6 +13,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   metrics:
@@ -22,20 +23,23 @@ jobs:
       - name: Generate GitHub repository metrics
         uses: lowlighter/metrics@latest
         with:
-          # Output path; the action commits this file back into the repo on changes.
+          # Output path; the action opens/updates a PR when this file changes.
+          # Requires manual review to merge. If metrics unchanged, no PR is created.
           filename: docs/assets/github-metrics.svg
 
-          # Auth: prefers a fine-grained PAT (richer plugins) but falls back to GITHUB_TOKEN.
-          # METRICS_TOKEN (fine-grained PAT) unlocks richer plugins (traffic, follow-up time);
-          # without it, GITHUB_TOKEN is sufficient for core metrics — the traffic / follow-up
-          # plugins simply silently no-op and the rest of the SVG still renders.
+          # Auth: METRICS_TOKEN must be a fine-grained PAT or GitHub App token that
+          # can create pull requests in this repository. GITHUB_TOKEN is kept only
+          # as a read/render fallback because many orgs disallow PR creation from it.
           token: ${{ secrets.METRICS_TOKEN || secrets.GITHUB_TOKEN }}
-          committer_token: ${{ secrets.GITHUB_TOKEN }}
+          committer_token: ${{ secrets.METRICS_TOKEN }}
+          output_action: pull-request
+          output_condition: data-changed
 
           # Use the repository template (per-repo metrics, not user metrics).
           # Organization-owned repositories must be targeted explicitly, otherwise
           # lowlighter/metrics infers the token owner and treats the target as an org.
           template: repository
+          base: ''
           user: nexu-io
           repo: open-design