bugfix(KLEF): Use PR flow to bump kleff-plugin.json on release

[JeremyNRoos]

Pull Request

Summary

• Fixes release workflow failing to push version bump directly to main due to branch protection rules
• Replaces direct git push origin HEAD:main with the same GitHub App PR + auto-merge pattern already used for the plugin-registry bump

Related Issues

No related issue — release was broken immediately after the auto-version-bump feature was merged.

---

Changes

What's Included

• release.yml: replaced direct push step with a GitHub Script step that creates a branch, commits the kleff-plugin.json version bump, opens a PR, and auto-merges it using the existing KLEFF_APP_ID / KLEFF_APP_PRIVATE_KEY app token
• release.yml: added Generate app token for self step to get a token scoped to keycloak-plugin

What's Not Included

• Changes to branch protection rules
• Changes to the registry auto-PR step (unaffected)

---

Testing

How Was This Tested?

• To be verified on next tag push

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

Uses the existing GitHub App (KLEFF_APP_ID / KLEFF_APP_PRIVATE_KEY) scoped to keycloak-plugin. No new secrets introduced. The app token is short-lived and generated per-run.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

---

UI/UX (If Applicable)

N/A

---

Pre-Merge Checklist

• PR title follows semantic format (fix: use PR flow to bump kleff-plugin.json on release)
• All CI checks passing
• No debug logs or commented-out code left in
• No sensitive information included

---

Reviewer Notes