Use GitHub App token for release tags

[dceoy]

Summary

• pass GH_APP_CLIENT_ID as the reusable workflow's app-client-id
• pass GH_APP_PRIVATE_KEY to the major-version-tag workflow
• retain the existing GH_TOKEN fallback

Root cause

The post-release workflow currently uses an Actions token to move the floating v0 tag. Updating v0 to v0.6.6 fails with Resource not accessible by integration (HTTP 403) because the target history includes workflow changes.

This opts opencode-action into the GitHub App token path added by dceoy/gha-for-devops#931.

Required repository configuration

• variable GH_APP_CLIENT_ID
• secret GH_APP_PRIVATE_KEY
• GitHub App installed on dceoy/opencode-action with Contents: read/write and Workflows: read/write

Validation

• one workflow file changed
• three lines added to the existing reusable workflow call
• no release-pin behavior is changed