ci(NoTicket): use GitHub App token for releases

[lorenzhs]

Release publishing currently fails at checkout because RELEASE_PAT no longer authenticates. Mint a short-lived, repository-scoped installation token using the org-wide FB_DB_CI_WRITER app and use it for checkout and the release action's version commit and tag pushes.

Use the same app secrets as the Go SDK: GH_APP_FB_DB_CI_WRITER_CLIENT_ID and GH_APP_FB_DB_CI_WRITER_APP_KEY_PEM, with only contents write permission requested. Pass the two staging credentials explicitly through the integration workflows instead of inheriting all secrets.

Checkout credentials remain persisted because the shared action-python-release runs git push origin internally. GitHub release creation retains the job's existing GITHUB_TOKEN contents write permission.

References: Kafka migration, Go SDK app setup, failed release.

Validation: workflow YAML, reusable workflow secret declarations, job dependencies, and applicable pre-commit checks pass. No release was triggered.

Before running a release, verify the org-wide app is installed on this repo and both org secrets are available to it. My account cannot inspect organization secret access policies.

---

Note

Medium Risk
Release publishing depends on new org app secrets and token minting; misconfiguration could block releases or affect git push during publish.

Overview
Fixes release workflow authentication by replacing the broken RELEASE_PAT checkout with a short-lived token from the org FB_DB_CI_WRITER GitHub App (actions/create-github-app-token, contents write only). Checkout now uses that token and sets persist-credentials: true so the shared action-python-release step can still push the version commit and tag.

Integration test wiring no longer uses secrets: inherit on reusable workflow calls in integration-tests.yml and release.yml; only the two staging Firebolt identity secrets are passed through explicitly to integration-tests-v2.

^{Reviewed by Cursor Bugbot for commit 64024cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[lorenzhs]

integration test trial run: https://github.com/firebolt-db/firebolt-python-sdk/actions/runs/37604834916 -- looking good