Replace create-pull-request with github-script

[chen-anders]

Similar to #73, this is a PR to replace peter-evans/create-pull-request with an first-party GitHub maintained actions/github-scriptequivalent. I figured that most orgs probably have the actions/github-script workflow step allowlisted.

Context: In our own org especially after the Trivy supply chain attacks, we've been wanting to be more restrictive with what 3rd-party GitHub actions can run on our workflows. (related issue: #58)

---

Disclaimer: Generated via Claude Code

Remove dependency on peter-evans/create-pull-request by using actions/github-script to implement PR creation directly.

Changes:

• Uses actions/github-script v8 (official GitHub action)
• Implements git operations (branch, commit, push) in JavaScript
• Maintains all existing functionality:
  • Custom author/committer support
  • Signoff support
  • Commit signing via gitsign (when enabled)
  • PR create/update/reopen detection
  • Label management
  • Only commits changed files
  • Outputs PR number for compatibility
• Simplified implementation (~140 lines)
• Removes unnecessary validation for workflow-controlled inputs
• Uses execFileSync with array arguments for security

Compatible with restricted GitHub Enterprise environments where community actions require whitelisting.

[cpanato]

do you have an example of a PR that was generated using this change?

also need to fix a conflict

[chen-anders]

I can put up a public repo example in the next day or two but we've been using our fork with this change in a number of our own internal repos.

[chen-anders]

example PR: https://github.com/wistia/digestabot-demo/pull/1/changes