fix(ci): run changeset release as bombshell-bot app (#123)

* fix(ci): run changeset release as bombshell-bot app

The Publish workflow passed the default `secrets.GITHUB_TOKEN` to
`changesets/action`, so the "Version Packages" PR, the version-bump
commit, and the release tag were all attributed to `github-actions[bot]`
instead of our `bombshell-bot` GitHub App like the other Bombshell repos.

Mint an installation token from the org-level `BOT_APP_ID` /
`BOT_PRIVATE_KEY` secrets via `actions/create-github-app-token`, check
out with it so the persisted git credentials push as the app, set the
git user to the app identity so the bump commit is authored by it, and
hand the token to `changesets/action` so it opens the PR as the app.

tty can't reuse `bombshell-dev/automation`'s publish workflow (that one
builds with pnpm/Node; tty builds WASM via make + Deno), so the app-token
pattern is inlined here. `push-with-git-cli: true` stays because the clay
submodule gitlink breaks the GitHub-API push path (0e10dcd), which is
also why the git-user config is needed for commit authorship.

* Apply suggestion from @natemoo-re

* Apply suggestion from @natemoo-re

Author: natemoo-re

.github/workflows/publish.yml

@@ -19,11 +19,25 @@ jobs:
       pull-requests: write # open the "Version Packages" PR
       id-token: write # npm publish via OIDC trusted publishing
     steps:
+      - name: generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
+          persist-credentials: true
+          token: ${{ steps.bot-token.outputs.token }}
+
+      - name: setup git user
+        run: |
+          git config --global user.name "bombshell-bot[bot]"
+          git config --global user.email "187071675+bombshell-bot[bot]@users.noreply.github.com"
 
       - name: setup deno
         uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
@@ -54,5 +68,4 @@ jobs:
           pr-title: "chore: version packages"
           create-github-releases: false
           push-with-git-cli: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.bot-token.outputs.token }}