ci(release): use GitHub App token for release-please

[krisarmstrong]

Summary

Replace the RELEASE_PLEASE_TOKEN PAT with a GitHub App installation token minted per-run via actions/create-github-app-token (org secrets APP_ID + APP_PRIVATE_KEY). App tokens don't expire out, aren't subject to the org's fine-grained-PAT lifetime policy, and still trigger the release workflow on tag push (unlike GITHUB_TOKEN). Org-level secrets make this work fleet-wide.

⚠️ DO NOT MERGE until the org secrets APP_ID and APP_PRIVATE_KEY are set (owner is creating the App). Merging before then breaks release-please (empty app-id).

Linked Issue

Related to #490

Testing Evidence

actionlint .github/workflows/release-please.yml -> clean
create-github-app-token pinned to bcd2ba49218906704ab6c1aa796996da409d3eb1 (v3.2.0)
release-please token input now: ${{ steps.app-token.outputs.token }}; RELEASE_PLEASE_TOKEN removed
Cannot run release-please auth locally (needs the App secrets) — verified by orchestrator after secrets are set.

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched.
• Dependencies are pinned and justified if changed.
• Documentation, screenshots, or operator notes were updated if behavior changed.

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 35 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)