Fix SYO prod promotion release identity

[cbusillo]

Objective

Make SYO production promotion release creation use an identity that can create the matching GitHub release/tag.

Finish Line

SYO prod promotion can create the release for the promoted revision

Current Status

State: Done through Option B. Launchplane now owns release creation during generic-web prod promotion; SYO Actions remains the manual workflow trigger but no longer creates the GitHub release directly.
Next action: None.
Blocked by: None.
Last verified: 2026-05-07. SYO Promote Testing to Prod run 25520881173 created release v0.2.10 via Launchplane-owned promotion flow, and the tag points at 215f71bc1a58639fe4bcd3b3609a4e68304184ab.

Scope

• SYO promote-prod.yml GitHub release creation step.
• Token/identity selection for creating releases/tags in a private repo.
• Guardrails so releases point at the promoted TESTED_REVISION only.

Acceptance Criteria

• The release creation step uses an explicit release-capable identity instead of an integration token that GitHub rejects.
• Release creation still verifies any existing tag points at TESTED_REVISION before proceeding.
• A failed release creation does not obscure whether Launchplane prod promotion succeeded.
• The chosen token/identity has minimal practical scope and is documented in workflow comments or Launchplane policy.
• Live validation creates the release for the recovered SYO promotion revision.

Relationships

Related to #418. This tracks the GitHub release half of the same failed SYO promote run.

Validation

• Dry-run or workflow syntax validation after token path changes.
• Live promote or release-only smoke creates the expected release/tag for the promoted revision.

Decisions

• Do not silently skip release creation long-term.
• Do not rely on GitHub default workflow token behavior for private-repo releases if GitHub is returning 403.

Open Questions

• Should release creation live in SYO Actions with a dedicated secret, or in Launchplane with a configured GitHub release identity?

[cbusillo]

Done via Option B in Launchplane PR #419 plus SYO PR #95. The manual SYO workflow still triggers promotion, but release creation now happens inside Launchplane using the configured context GitHub identity. Live run 25520881173 created v0.2.10 for commit 215f71bc1a58639fe4bcd3b3609a4e68304184ab.