[lucarlig]

Release tagging fails when GitHub requires workflow-file write permission: the built-in GITHUB_TOKEN cannot grant it. Both attempts of CI run 38554114826 passed their build and test jobs, then failed pushing rate-limiter-v0.1.12.

Use a short-lived GitHub App installation token, restricted to this repository and Contents/Workflows write permissions, for checkout and tag pushes in both CI workflows. Let the existing tag-push triggers start releases and remove the explicit dispatch to prevent duplicate release runs. Keep existing tags immutable and document how to retry an existing release.

The new dependency is GitHub's official actions/create-github-app-token v3.3.0, pinned to its commit SHA (MIT licensed); it revokes the token when the job finishes. No published repository security advisories were listed when checked.

Validation: uv run --no-project --python 3.12 make plugins-validate passed (41 tests); actionlint passed for both changed workflows; git diff --check passed.

Before merging, a repository or organization admin must install an approved release App on IBM/cpex-plugins with Contents and Workflows read/write permissions, configure Actions variable RELEASE_APP_CLIENT_ID and secret RELEASE_APP_PRIVATE_KEY, and allow the App through any applicable tag-creation rules. No release App credentials are currently configured, so the live token flow cannot yet be verified.

Release recovery: rate-limiter-v0.1.12 was pushed at the exact tested commit 1b4577fb92b5085c3840e1d6ce08ddc6594130bb, starting release run 38750763260. This recovery is independent of the workflow changes in this PR.