ci(release): authenticate changesets/action with a GitHub App token

The "Version Packages" PR (currently #4) sits in `BLOCKED` state
because the 10 status checks required by branch protection on
`main` (CI matrix + Build + Run ghau against this repo) never
start for that PR. GitHub Actions' documented anti-loop rule
suppresses workflow triggers for pushes authored by
`GITHUB_TOKEN`, and that's exactly the token changesets/action
uses to push to `changeset-release/main`. CodeQL runs because it
bypasses the rule via default-setup, but everything else stays
idle, leaving the release PR unmergeable.

Fix: mint a short-lived installation token from a dedicated
GitHub App (`RELEASE_APP_ID` + `RELEASE_APP_PRIVATE_KEY` repo
secrets, both already configured) and pass that to
changesets/action's `GITHUB_TOKEN`. App-authored pushes trigger
workflows like a human push does, so the next time
changesets/action updates the version-PR branch, CI + the
self-check workflow run against the new tip and branch
protection clears.

The App is scoped to this repo with `Contents: Read and write` +
`Pull requests: Read and write` — exactly the perms
changesets/action needs and nothing more. No personal-account
coupling, no perma-token; the installation token is minted fresh
for each workflow run by `actions/create-github-app-token@v1`
and expires shortly after.

The trailing "Update floating v<major> tag" step keeps using the
default `GITHUB_TOKEN`-authenticated remote — a tag move doesn't
need to trigger any downstream workflow we care about, so the
broader-permission App token is unnecessary there.

Author: ylabonte

.github/workflows/release.yml

@@ -32,14 +32,19 @@ jobs:
       - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - name: Create release PR or publish
         id: changesets
         uses: changesets/action@v1
         with:
           publish: pnpm release
           version: pnpm exec changeset version
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           NPM_CONFIG_PROVENANCE: 'true'
 
       # When a publish actually happened, force-push the floating major-version tag