ci: mint App token so commit-back can bypass branch protection (PoC)

[fiunchinho]

Summary

Fix the CHANGELOG.md commit-back failure observed on v1.5.0's release run by minting an installation token from the existing release-please-workflow GitHub App (already bypass-listed) and passing it to actions/checkout so the subsequent git push carries a bypass-listed identity.

This unblocks end-to-end validation of the auto-update-CHANGELOG.md design. PoC scaffolding only — the long-term plan is a Rulesets migration that bypasses GitHub Actions directly, at which point this step is deleted.

What changed

One new step + a token: line on the existing checkout. No other workflow logic touched.

- name: Mint App token for commit-back
  id: app-token
  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
  with:
    app-id: ${{ secrets.RELEASE_PLEASE_CLIENT_ID }}
    private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}

- name: Checkout
  uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  with:
    token: ${{ steps.app-token.outputs.token }}
    fetch-depth: 0
    fetch-tags: true

Why this works

• The release-please-workflow App (client_id: Iv23li4D87rTS1cOd8GQ) is in the branch-protection bypass list with contents: write.
• actions/create-github-app-token@v3.2.0 accepts the org-level RELEASE_PLEASE_CLIENT_ID + RELEASE_PLEASE_PRIVATE_KEY secrets that are already visible to this repo (no setup needed).
• The minted token has the App's identity. When actions/checkout configures git with that token, the subsequent git push inherits the bypass.

Test plan

Merging this PR is itself the test:

• Workflow triggers on the merge commit (this PR is ci:, which is grouped under "Changed" and bumps patch -> v1.5.1).
• gh release create succeeds (same as v1.5.0).
• Commit-back step now succeeds. A chore: update CHANGELOG.md for v1.5.1 [skip ci] commit lands on main.
• Inspecting CHANGELOG.md on main: a new ## [v1.5.1](compare/v1.5.0...v1.5.1) - 2026-06-03 section is spliced directly under the <!-- auto-release: insert below --> marker.
• The chore commit does NOT trigger another auto-release run ([skip ci] works).

Note on permanent v1.5.0 gap: v1.5.0's CHANGELOG.md section was lost when its commit-back failed. After this PoC validates, we can either backfill v1.5.0 in a one-off PR, or accept that v1.5.0 lives only in the GitHub Releases page.

Out of scope

• The muster #795, agentic-platform #25, agentic-platform-mcps fix: tighten release-notes whitespace in cliff template #10 PRs all carry the same commit-back step but none have App-token wiring yet. If this PoC validates, each of those repos needs the equivalent wiring (or a Rulesets migration) before the commit-back works there. Will follow up.