chore: use GitHub App token for Homebrew tap in release workflow

[Bucknalla]

Summary

• Replaces the TAP_GITHUB_TOKEN fine-grained PAT with a short-lived token minted at runtime via a GitHub App (actions/create-github-app-token@v2)
• The Blues org policy forbids fine-grained PATs with lifetimes > 7 days, which was causing the release workflow to fail at the Homebrew cask publish step
• The new approach generates a token scoped only to blues/homebrew-note-cli for each run

Pre-merge setup required

Before merging, the following must be in place:

1. Create a GitHub App in the Blues org with Contents: Read & Write permission
2. Install the App on the homebrew-note-cli repository only
3. Add two repository secrets to note-cli:
   • TAP_APP_ID — the numeric App ID
   • TAP_APP_PRIVATE_KEY — the PEM private key

The existing TAP_GITHUB_TOKEN secret can be removed once this is merged and verified.

Test plan

• GitHub App created and installed on blues/homebrew-note-cli
• TAP_APP_ID and TAP_APP_PRIVATE_KEY secrets added to this repo
• Trigger a workflow_dispatch run to verify the token is minted and the Homebrew cask step succeeds before the next real release

🤖 Generated with Claude Code