fix(release): fall back when configured token is rejected

[0xPlayerOne]

Summary

Make Release Please token-aware for repositories whose configured automation token is rejected by GitHub policy.

Behavior

• Probe CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN against the current repository without logging it.
• Use the configured token only after successful validation.
• Fall back to the short-lived workflow token when the secret is absent or rejected.
• Leave the generated release PR for manual merge when fallback is active.
• Reuse the selected credential for release-PR and post-release operations.
• Preserve the flat Release / Version, Reconcile, Post Hook, and Publish npm checks.

Validation

• 94/94 Node tests pass.
• actionlint passes.
• Type-check, build, format, lint, and pack checks pass.