bump-consumers: its own MAROLA_BUMP_PAT, not the shared cross-repo PAT #63

What

v0.7.0's bump-consumers run (37998968013) failed in all six repos: MAROLA_CROSS_REPO_PAT has no Workflows write, which a pin bump in .github/workflows/*.yml needs (refusing to allow a Personal Access Token to create or update workflow … without workflow scope). That token is passed to 10 workflows across the six repos (every notify-umbrella run, marola-app ci.yml/docker-smoke.yml, marola-ml compile-prompt.yml, the umbrella's ci.yml/pointer-sync.yml). With Workflows write, any of them could push a branch carrying a new workflow that runs with that repo's secrets, so the bump gets its own token instead: MAROLA_BUMP_PAT (Contents, Pull requests and Workflows read & write, Metadata read; owner marola-dev, all repositories), an org secret whose repository access is marola-devkit alone. This reverses #54's "no new token".

Acceptance criteria

• bump-consumers.yml and release.yml pass and read MAROLA_BUMP_PAT; MAROLA_CROSS_REPO_PAT appears nowhere in the bump path
• bump-consumers.sh's empty-token message, docs/3-development.md's Releases section and a docs/4-reference_config.md row name MAROLA_BUMP_PAT, its four permissions and that only marola-devkit may read it
• after merge, gh workflow run bump-consumers.yml -f version=0.7.0 opens the six v0.7.0 bump PRs (links in the PR)

Named test

actionlint; bash scripts/bump-consumers.sh --self-test; docs_lint; the re-run's six PR links.