fix: use pull requests for feature tracker updates instead of direct push

[lgallard]

Problem

The AWS Backup Feature Discovery workflow is failing at the 'Commit feature tracker updates' step with a protected branch error (GH006). The workflow was trying to push directly to the master branch, which requires changes to be made through pull requests.

Solution

• Replace direct push with automated PR creation for tracker updates
• Add GitHub token environment to the commit step for proper authentication
• Use existing repository labels (aws-backup, ci-cd, configuration) for PR creation
• Preserve atomic operations and file locking for safe tracker updates

Technical Details

Before:

git push origin HEAD  # ❌ Fails due to protected branch

After:

BRANCH_NAME="feature-discovery/tracker-update-$(date +%Y%m%d-%H%M%S)"
git checkout -b "$BRANCH_NAME"
git push origin "$BRANCH_NAME"
gh pr create --title "chore: update tracker" --body "..." --label "aws-backup,ci-cd,configuration"

Impact

• ✅ Workflow completes successfully without protected branch errors
• ✅ Tracker updates are reviewed via automated PRs
• ✅ Maintains audit trail for all feature discovery changes
• ✅ Preserves existing validation and atomic operations

Test Plan

• Verify labels exist in repository
• Confirm GitHub token permissions
• Run workflow end-to-end to test PR creation
• Verify tracker file updates are properly committed to branch