fix(ci): use GH App token for release PR job to trigger CI naturally

[rhuanbarreto]

Summary

• Closes the recurring class of bug where release PRs land without their required status checks attached to the PR ref (most recently observed on #251, where Lint, Test & Check was missing from the PR rollup).
• Replaces the workflow_dispatch + manual commit-status workaround introduced in #131 with the proper fix: use a GitHub App installation token so simple-release-action's push triggers pull_request events naturally.
• Narrows the pull-request job permissions to contents: read (the App token carries the writes).

Root cause

release.yml's pull-request job was passing ${{ github.token }} (the default GITHUB_TOKEN) to simple-release-action. GitHub intentionally suppresses push / pull_request events on GITHUB_TOKEN-authored pushes to prevent workflow recursion. As a result:

1. No pull_request (synchronize) event fired on the release PR.
2. code-pull-request.yml (Lint, Test & Check, smoke tests) and dco.yml never ran on refs/pull/N/head.
3. The previous workaround compensated by triggering CI via gh workflow run code-pull-request.yml --ref release and posting Validate Code / DCO Sign-off Check as commit statuses. But those workflow_dispatch runs land on head_branch: release with pull_requests: [] — their check runs are not associated with the PR ref, so branch protection treated Lint, Test & Check as missing on the PR.

Fix

In the pull-request job:

• Generate a GitHub App installation token via actions/create-github-app-token using secrets.GH_APP_APP_ID / secrets.GH_APP_PRIVATE_KEY (same pattern the check and release jobs already use).
• Pass that token to both actions/checkout and simple-release-action.
• Drop the entire Run CI and set status checks on release PR step — code-pull-request.yml and dco.yml now run naturally on the synchronize event.
• Reduce job permissions from actions: write / contents: write / pull-requests: write / statuses: write to contents: read.

App-token-authored pushes DO trigger downstream workflow events, so the full set of required checks now appears on refs/pull/N/head and branch protection accepts them.

Note about #251

This fix only takes effect for future release PRs (e.g., 0.31.2). PR #251 itself still has the orphaned check problem and needs to be admin-merged or recreated by closing it and pushing a new commit to main.

Test plan

• Merge this PR.
• Trigger a new release to main (any user-visible change) and confirm simple-release-action opens a release PR whose head SHA shows Validate Code, Lint, Test & Check, smoke tests, and DCO Sign-off Check all under the PR ref (not just on the commit).
• Confirm mergeStateStatus is no longer BLOCKED for missing required checks (review requirement still applies, as expected).
• Verify the pull-request job logs show the App token being generated and the Create or update pull request step using it.

[cloudflare-workers-and-pages]

Deploying archgate-cli with    Cloudflare Pages

Latest commit:	325182b
Status:	✅  Deploy successful!
Preview URL:	https://88fdf3c0.archgate-cli.pages.dev
Branch Preview URL:	https://fix-release-pr-status-checks.archgate-cli.pages.dev

View logs