[dependabot:release-train-updater] create_pull_request fails with "No changes to commit" in same-repo mode (regression beyond #6830 scope)

## Summary

The `create_pull_request` safe-output tool consistently fails with `"No changes to commit - no commits found"` when the release-train-updater worker runs in **same-repo** mode (target_repo == workspace root == `githubnext/gh-aw-cao` itself), even though the commit is unambiguously present and ahead of `origin/main`.

This was previously tracked and believed fixed by #6830 (closed, merged fix for **cross-repo** authentication — an App token scoped only to the control repo). However, this failure reproduces in the trivial same-repo case, which #6830's fix did not appear to address, or a related regression has reappeared.

## Reproduction (this run)

- Correlation ID: `34437160581-175`
- Branch: `dependabot-agent/astro-family-patch-0910-2`, commit `67ccb45d`
- Verified locally before calling the tool:
- `git log origin/main..HEAD` → exactly 1 commit (`67ccb45d Bump astro, @astrojs/markdown-remark, @github/copilot-sdk (patch)`)
- `git rev-parse HEAD` == branch tip == `67ccb45ded0adcfb969ad0c75d9128fc2c871f4e`
- `git status` clean except unrelated untracked `.local/` / `target/` dirs
- Called `create_pull_request` via `safeoutputs` CLI **twice** (once without `base`, once with `base: "main"` explicitly set) — both attempts returned the identical error in well under 150ms:
```json
{"result":"error","error":"No changes to commit - no commits found","details":"No commits were found to create a pull request. Make sure you have committed your changes using git add and git commit before calling create_pull_request."}
```
- The very fast (76–122ms) response time for both attempts suggests the tool may be failing before it even performs a real git diff check against the branch — possibly a stale/cached view of `origin/main`, a race in server-side ahead-of-main detection, or a credential/token issue causing an early short-circuit that surfaces as this specific error message.

## Prior occurrences (from cache-memory history, same defect class)

- 2026-09-10 01:55 UTC run: identical error, same-repo case (`githubnext/gh-aw-cao` as its own target), 2 attempts, both failed.
- 2026-09-09 20:30 UTC and earlier runs: cross-repo case, tracked as #6830/#6618 (closed as fixed).
- 2026-09-10 03:40 UTC run (cross-repo, `github/gh-aw` target): tool returned a `success` response with patch/bundle metadata, but the branch/PR did not durably land on a subsequent verification pass — a related but distinct non-durability symptom that may share a root cause with this one.

## Impact

The dependabot release-train-updater worker has been unable to land any dependency PR for `githubnext/gh-aw-cao` (same-repo case) across at least 2 consecutive runs with fully validated, low-risk candidates (patch-level npm bumps, clean diffs, passing `gh aw compile`). Routine dependency maintenance for this repository is currently blocked by this tool defect rather than by any candidate-specific risk.

## Requested action

- Re-investigate whether #6830's fix (disabling the inherited App token, relying on `GH_AW_GITHUB_TOKEN`) covers the same-repo path, or only the cross-repo path.
- Add regression coverage for `create_pull_request` in the same-repo case (target_repo == control repo) to prevent silent regressions.
- Consider adding server-side logging/diagnostics for this specific error path so future occurrences can be root-caused faster (e.g., what `origin/main` SHA the tool believes it's comparing against at failure time).

## Control Plane
- Correlation ID: 34437160581-175
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34437160581

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34437451542) · copilot · auto · 85.3 AIC · ⌖ 10.7 AIC · ⊞ 18K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 24, 2026, 4:39 AM UTC

Start at the create_pull_request safe-output tool and reproduce the same-repo case through the safeoutputs CLI, comparing behavior with the cross-repo fix in #6830. Add regression coverage for target_repo equal to the control repository and verify that a committed branch ahead of main creates a durable pull request; consider diagnostics for the reported no-commits path.

Written by the indexing model from the issue text.