fix: use GitHub App token for Homebrew tap updates

[rgarcia]

Summary

Replace HOMEBREW_TAP_GITHUB_TOKEN PAT with kernel-internal app token for GoReleaser Homebrew tap updates.

Changes

• Add step to generate GitHub App token scoped to kernel/homebrew-tap repository
• Replace secrets.HOMEBREW_TAP_GITHUB_TOKEN with the generated app token in GoReleaser environment

Test plan

• Verify the workflow runs successfully on the next release tag
• Confirm GoReleaser can push to kernel/homebrew-tap using the app token

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes release automation credentials to a GitHub App token, which can affect publishing if app permissions/secrets are misconfigured, but is limited to the release workflow.

Overview
Updates the Publish Release GitHub Actions workflow to mint a GitHub App installation token (via actions/create-github-app-token) scoped to kernel/homebrew-tap.

GoReleaser now uses this generated token for HOMEBREW_TAP_GITHUB_TOKEN instead of a stored secret PAT, changing how Homebrew tap updates are authenticated during releases.

^{Written by Cursor Bugbot for commit bd85d3d. This will update automatically on new commits. Configure here.}