[P3] GitHub App secret names diverge across workflows (BOT_* vs MISO_*)

[itsmiso-ai]

Ask: Standardize the GitHub App secret names across workflows so rotation, audits, and onboarding all reference one set.

Expected files: .github/workflows/release-please.yaml, .github/workflows/manual-release.yml, .github/workflows/ai-pr-review.yaml, .github/workflows/release.yml

Problem:
The workflows use two different sets of secret names for the same GitHub App:

• manual-release.yml and ai-pr-review.yaml use secrets.BOT_CLIENT_ID and secrets.BOT_APP_PRIVATE_KEY.
• release-please.yaml uses secrets.MISO_APP_ID and secrets.MISO_APP_PRIVATE_KEY.

Two name schemes for the same purpose is a rotation and audit hazard: a person updating one workflow's secrets won't know they need to update the other pair, and a secret-rotation runbook has to enumerate both. New workflows added later will pick whichever example they copy first, making the divergence worse.

Evidence:

• .github/workflows/manual-release.yml — client-id: ${{ secrets.BOT_CLIENT_ID }}, private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}.
• .github/workflows/ai-pr-review.yaml — same BOT_CLIENT_ID / BOT_APP_PRIVATE_KEY pair.
• .github/workflows/release-please.yaml — app-id: ${{ secrets.MISO_APP_ID }}, private-key: ${{ secrets.MISO_APP_PRIVATE_KEY }}.
• .github/workflows/release.yml — does not mint its own token (relies on the default GITHUB_TOKEN); no softprops/action-gh-release token override.

Acceptance:

• All workflows that mint a GitHub App token reference the same secret names (pick one pair and migrate the other).
• A note in docs/ (or a top-level contributor doc) records the canonical secret names so future workflows pick them up consistently.