bugfix(KLEF): Use plugin.json as source of truth

[JeremyNRoos]

Pull Request

Summary

• Removes the kleff-plugin.json auto-version-bump step from the release workflow
• The step was failing because the GitHub App is not installed on this repo, and GITHUB_TOKEN cannot merge PRs on protected branches
• kleff-plugin.json version is a nice-to-have; plugins.json in the registry is the source of truth the platform reads

Related Issues

No related issue — unblocks the release workflow from completing successfully.

---

Changes

What's Included

• release.yml: removed Generate app token for self and Bump version in kleff-plugin.json steps
• release.yml: reverted contents permission back to read

What's Not Included

• Auto-bumping kleff-plugin.json — this will be done manually as part of plugin PRs

---

Testing

How Was This Tested?

• Verified on next tag push after merge

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

Reduces permissions — contents downgraded from write back to read.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

---

UI/UX (If Applicable)

N/A

---

Pre-Merge Checklist

• PR title follows semantic format (fix: remove self-version-bump from release workflow)
• All CI checks passing
• No debug logs or commented-out code left in
• No sensitive information included

---

Reviewer Notes