fix(ci): pass App token to checkout so the persisted git credential is App-authored

Copilot caught a real gap in the previous commit on this PR:
setting `env.GITHUB_TOKEN` for changesets/action only affects
the action's Octokit calls (PR creation, etc.). The actual
`git push origin changeset-release/main` that changesets/action
performs uses **git's persisted remote credential**, not the env
var. `actions/checkout@v6` persists `secrets.GITHUB_TOKEN` into
git config by default, so the push was still GITHUB_TOKEN-
authored — the workflow-trigger suppression we were trying to
bypass would have continued to bite.

Fix:

- Mint the App token *before* checkout (was: after `pnpm build`).
- Pass it to checkout via `token: ${{ steps.app-token.outputs.token }}`,
  so the persisted credential is the App token's.
- changesets/action's `env.GITHUB_TOKEN` stays on the App token
  (it was already correct; this just makes the push credential
  align with the API credential).

Side-effect: the trailing "Update floating v<major> tag" step
now also pushes under the App identity (because it uses the
same persisted git credential). That's fine — the App has
`Contents: write`, and the tag push doesn't trigger any
workflow we care about, so the broader-permission credential
changes nothing functional there.

Author: ylabonte

.github/workflows/release.yml

@@ -19,9 +19,21 @@ jobs:
     runs-on: ubuntu-latest
     environment: npm-publish
     steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+      # Pass the App token to checkout so the credential persisted into git
+      # config is the App's, not the default GITHUB_TOKEN. `git push` from
+      # changesets/action (and from later steps in this job) is then
+      # App-authored, which triggers downstream workflows. Setting env
+      # GITHUB_TOKEN alone is not enough — checkout's persisted credential is
+      # what `git push` actually uses.
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -32,11 +44,6 @@ jobs:
       - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - name: Create release PR or publish
         id: changesets
         uses: changesets/action@v1