make the ci use short lived token for GHA #108

Outcome

Remove the long-lived release PAT from GitHub Actions and mint short-lived GitHub App installation tokens at the point of use.

Acceptance criteria

• One least-privilege GitHub App is installed on gridness/a365dt and Gridness/homebrew-oosama.
• Repository configuration uses vars.RELEASE_APP_CLIENT_ID and secrets.RELEASE_APP_PRIVATE_KEY.
• Every current secrets.RELEASE_PAT use is replaced.
• The release-PR, merge, GitHub-release, and Homebrew-publish jobs mint independent installation tokens rather than forwarding one token through the workflow.
• Token requests list only the repositories and permissions needed by that job.
• The App can create/update the release PR, push the lockfile update, merge through the existing ruleset, create/publish releases, and push the Homebrew formula.
• Existing job-scoped GITHUB_TOKEN and OIDC use remain in place where cross-repository/App authority is unnecessary.
• A repeatable setup wizard documents App creation, exact permissions, installation, ruleset bypass, private-key generation, Actions variable/secret configuration, and non-secret verification.
• RELEASE_PAT is considered removable only after a successful end-to-end release dry run; no credential values are logged.

Required App repository permissions

• Contents: read and write.
• Issues: read and write.
• Pull requests: read and write.
• Metadata: read-only (mandatory).

The App must be added as an allowed bypass actor for the main read-only ruleset instead of receiving broad repository-administration permission.

Validation

• Workflow YAML and action inputs are linted/inspected.
• A dry run proves release-PR creation/update and cross-repository checkout/push before the old PAT is removed.