ci: allow Hypercerts Release Bot GitHub App to bypass branch protection

[aspiers]

The release workflow needs to be able to push commits and tags directly to the repo when making a beta release. The default github-actions[bot] identity can't be added to branch protection ruleset bypass lists, so a new Release Bot GitHub App has been created which should facilitate this bypass mechanism.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 87edff0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This PR enables the Hypercerts Release Bot GitHub App to bypass branch protection rules during the release workflow. The default github-actions[bot] identity cannot be added to branch protection ruleset bypass lists, so this change introduces a GitHub App with appropriate credentials to facilitate automated releases.

Key changes:

• Add GitHub App token generation step using actions/create-github-app-token@v1 with secrets for app credentials
• Update checkout action to use the generated app token for authenticated git operations
• Enable credential persistence to allow subsequent git push operations to bypass branch protection

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment refers to "releasebot" but the GitHub App is called "Release Bot" (with a space). Consider using consistent naming, such as "Release Bot app credentials" to match the app name used in the PR title and description.

Suggested change

	# Persist releasebot app credentials to ensure that the push
	# Persist Release Bot app credentials to ensure that the push