feat(gen): add --auto-release-level flag, fix release-please App secrets

[fiunchinho]

What

Lets repositories opt the release-please workflow into auto-merging its Release PR, by wiring devctl to the auto-merge-level input added to the giantswarm/github-workflows release.yaml reusable workflow (giantswarm/github-workflows#185, merged).

• New gen workflows flag --auto-release-level (none | patch | minor | major; default none), only meaningful with --release-workflow=release-please. It sets the reusable workflow's auto-merge-level input. Invalid values are rejected at gen time.
• Fixes the generated secrets. The template still passed TAYLORBOT_GITHUB_ACTION, but the reusable workflow switched to GitHub App auth and now requires RELEASE_PLEASE_CLIENT_ID + RELEASE_PLEASE_PRIVATE_KEY (the former feeds create-github-app-token's client-id). The generated release-please.yaml was therefore non-functional against release.yaml@main; this corrects it.

Generated output

--auto-release-level minor:

  release_please:
    uses: giantswarm/github-workflows/.github/workflows/release.yaml@main
    permissions:
      contents: write
      pull-requests: write
    with:
      auto-merge-level: minor
    secrets:
      RELEASE_PLEASE_CLIENT_ID: ${{ secrets.RELEASE_PLEASE_CLIENT_ID }}
      RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}

Default (no flag) renders auto-merge-level: none.

Relationship to other PRs

• Supersedes draft feat(gen): release-please workflow passes GitHub App secrets #1843 (which fixed the secrets but used RELEASE_PLEASE_APP_ID; the reusable workflow requires RELEASE_PLEASE_CLIENT_ID, not APP_ID). Suggest closing feat(gen): release-please workflow passes GitHub App secrets #1843 in favor of this. The auth wiring originates in feat: add release-please workflow generation #1831.

Consuming-repo prerequisites for auto-merge

• RELEASE_PLEASE_CLIENT_ID and RELEASE_PLEASE_PRIVATE_KEY available as org/repo secrets.
• "Allow auto-merge" enabled in repo settings.
• release-please GitHub App on the default branch's protection/ruleset bypass list.

Verification

• go generate ./... && go build ./... and go test ./pkg/gen/input/workflows/... ./cmd/gen/workflows/... pass; gofmt/go vet clean.
• Rendered end-to-end in a scratch repo for minor, default (none), and an invalid value (rejected by validation).