Use release app for protected branch updates

[simple-analytics-ai]

Summary

• authenticate the release workflow with a short-lived GitHub App installation token
• keep the default GitHub Actions token read-only and use the app token for the protected-branch push and GitHub release
• attribute generated release commits to the release app bot

Setup required before merge

• install the simpleanalytics-release app only on simpleanalytics/wordpress-plugin with Contents read/write
• add the app to the organization ruleset bypass list with Always allow
• add the repository variable RELEASE_APP_ID
• add the repository secret RELEASE_APP_PRIVATE_KEY

Validation

• actionlint .github/workflows/release.yml
• git diff --check main...HEAD

This addresses the protected-branch failure in release run https://github.com/simpleanalytics/wordpress-plugin/actions/runs/35030881136/job/104589753054.