fix(ci): use GitHub App token for semantic-release to bypass branch ruleset (#32)

The release workflow was failing because GITHUB_TOKEN (github-actions[bot])
cannot push directly to main when branch protection requires pull requests.
On GitHub Free, the built-in GitHub Actions integration cannot be added as
a bypass actor in rulesets.

Switch to authenticating via the ambient-code GitHub App using
actions/create-github-app-token, which generates a short-lived token that
can bypass the "Protect main" ruleset.

Requires repo secrets: RELEASE_APP_ID, RELEASE_APP_PRIVATE_KEY

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jeremyeder

.github/workflows/release.yml

@@ -19,11 +19,19 @@ jobs:
       url: https://pypi.org/project/mcp-acp/
 
     steps:
+      - name: Generate release token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           persist-credentials: true
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -40,7 +48,7 @@ jobs:
         id: release
         uses: python-semantic-release/python-semantic-release@v9.15.2
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}
 
       - name: Clean stale build artifacts
         if: steps.release.outputs.released == 'true'
@@ -60,4 +68,4 @@ jobs:
         if: steps.release.outputs.released == 'true'
         uses: python-semantic-release/publish-action@v9.15.2
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}