chore: use GitHub App token for Homebrew tap in release workflow

[Bucknalla]

Summary

• Replaces the TAP_GITHUB_TOKEN fine-grained PAT with a short-lived token minted at runtime via a GitHub App (actions/create-github-app-token@v2)
• The Blues org policy forbids fine-grained PATs with lifetimes > 7 days, which was causing the release workflow to fail at the Homebrew cask publish step
• The new approach generates a token scoped only to blues/homebrew-note-cli for each run

Pre-merge setup required

Before merging, the following must be in place:

1. Create a GitHub App in the Blues org with Contents: Read & Write permission
2. Install the App on the homebrew-note-cli repository only
3. Add two repository secrets to note-cli:
   • TAP_APP_ID — the numeric App ID
   • TAP_APP_PRIVATE_KEY — the PEM private key

The existing TAP_GITHUB_TOKEN secret can be removed once this is merged and verified.

Test plan

• GitHub App created and installed on blues/homebrew-note-cli
• TAP_APP_ID and TAP_APP_PRIVATE_KEY secrets added to this repo
• Trigger a workflow_dispatch run to verify the token is minted and the Homebrew cask step succeeds before the next real release

🤖 Generated with Claude Code

[zakoverflow]

Review

Approve.

Checked

• Rebased on current master (5c8b42b); 0 commits behind
• Go version aligned at 1.25.0
• CI audit passing on head 6dfffcc
• Diff is minimal and correct:
  • mint short-lived token with actions/create-github-app-token@v2
  • scope to blues/homebrew-note-cli
  • pass token to GoReleaser as TAP_GITHUB_TOKEN
• Matches .goreleaser.yaml homebrew_casks token usage

Pre-merge setup

App + secrets setup is complete on our side.

After merge

1. Run release workflow via workflow_dispatch
2. Confirm tap-token mint + Homebrew publish succeed
3. Remove old TAP_GITHUB_TOKEN secret

No code issues found.