Migrate create-github-app-token from app-id to client-id

[lex57ukr]

Goal

Silence the deprecation warning emitted by actions/create-github-app-token in
.github/workflows/release.yml by migrating from the deprecated app-id input
to the new client-id input introduced in v3.1.0 (2026-04-11).

Scope

• Retrieve the GitHub App's Client ID (string value, e.g. Iv23li...) — distinct from the numeric App ID currently stored as APP_ID.
• Store the Client ID in the repo (as a variable per upstream convention, or as a secret) and update .github/workflows/release.yml:200 to pass client-id: instead of app-id:.
• Remove the now-unused APP_ID secret once the workflow is green.

Outcome

Release workflow runs without the Input 'app-id' has been deprecated warning
and stays aligned with the upstream action's recommended usage, so a future
major bump that removes app-id entirely won't break releases.

Notes

• Upstream PR: feat: add client-id input and deprecate app-id actions/create-github-app-token#353 — app-id still works as a fallback today, so this is not urgent, but the input will be removed in a future major.
• Client ID is a public identifier; upstream README now uses vars.GITHUB_APP_CLIENT_ID rather than a secret.
• Action is currently referenced as @v3 (floating tag). Pinning is tracked separately in Pin GitHub Actions to commit SHAs #183 — ideally land that first so this migration lands as a SHA bump + input rename in one PR.
• Tracked alongside knight-owl-dev/devops#120.

[lex57ukr]

Implementation note: use client-id: ${{ vars.APP_CLIENT_ID }} — store the Client ID as a repo variable (APP_CLIENT_ID), not a secret. Matches upstream README convention and the pattern landed in knight-owl-dev/devops#121.