[Bugs5382]

What and why

Brings this repo's workflows in line with the hub fixes tracked in Bugs5382/project-template#73.

• Release Drafter on release-drafter/release-drafter@v7, token passed as with: token: instead of env: GITHUB_TOKEN (Bugs5382/project-template#56, Bugs5382/project-template#59). The token stays the GitHub App token (steps.app-token.outputs.token) this workflow already uses, since the same run pushes the CHANGELOG commit; only the version and how the token is passed change. The v7 outputs used by the later steps (body, resolved_version) are unchanged.
• arduino/setup-task authenticated with repo-token: ${{ secrets.GITHUB_TOKEN }} (Bugs5382/project-template#60). Already on main: job-golic.yaml uses arduino/setup-task@v2 with repo-token, matching the current hub template. No change needed.

Skipped-job display names are left as they are on purpose. A job skipped on a title or body edit shows the raw ${{ ... }} name expression, but this repo reruns PR workflows on edited (so a retargeted stacked PR starts CI). With a static name, the skipped edit run would share the real check's name and count as passing, which could hide a failed check. The hub templates use static names because they don't trigger on edited.

No docs change: CI workflow only.

Closes #102

Verification

• Lint clean
• Tests pass
• Build succeeds

How this was verified

• actionlint .github/workflows/release-drafter.yml: clean.
• task license (golic v1.2.0 dry run): 0/181 changed, exit 0.
• npm ci --ignore-scripts, npm run lint, npm run test (373 passed), npm run build: all pass, tree clean afterwards.
• Release Drafter runs only on push to main and stays gated on vars.APP_CLIENT_ID, so this PR's checks don't exercise it.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Closing summary: moves release-drafter from v6 to v7 with the token passed as the token input (the repo's GitHub App token, which pushes the changelog commit). The setup-task repo-token item was already on main. The skipped-job names are kept as expressions on purpose: these workflows re-run on PR edits, and a static name would let an edit-skipped run share the real check's name. Signed off.