ci: use client-id instead of deprecated app-id for cli releaser github app

[zimeg]

What

actions/create-github-app-token deprecated its app-id input in favor of client-id. Every run of release.yml and dependencies.yml was logging:

Input 'app-id' has been deprecated with message: Use 'client-id' instead.

This switches both token steps to client-id.

✅ Secret in place — ready to merge

client-id takes the App's Client ID (string like Iv23li…), not the numeric App ID that app-id took. The required repo secret GH_APP_CLIENT_ID_RELEASER has been added (value = the releaser App's Client ID). Both workflow lines reference it. GH_APP_PRIVATE_KEY_RELEASER is unchanged.

Files

• .github/workflows/release.yml
• .github/workflows/dependencies.yml

Notes

• The old GH_APP_ID_RELEASER secret is no longer referenced by any workflow — safe to delete after merge, or leave in place (harmless).
• Non-breaking on its own — app-id still functioned; this clears the deprecation warning and future-proofs against its eventual removal.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.25%. Comparing base (47c79eb) to head (203cd90).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #639      +/-   ##
==========================================
+ Coverage   72.22%   72.25%   +0.02%     
==========================================
  Files         238      238              
  Lines       20072    20072              
==========================================
+ Hits        14497    14503       +6     
+ Misses       4302     4300       -2     
+ Partials     1273     1269       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mwbrooks]

Nice cleanup — clears the deprecation warning and the diff is minimal. LGTM on the two workflow files.

One follow-up before merge: .github/MAINTAINERS_GUIDE.md:537 still lists GH_APP_ID_RELEASER in the "Credentials and secrets" section. After this PR, no workflow references that secret, so anyone bootstrapping the releaser app from the maintainer guide (fork, rotation, new environment) would set the wrong secret name and hit an empty client-id at runtime. Suggest updating that bullet to GH_APP_CLIENT_ID_RELEASER in this PR so the docs and workflows stay in sync.

While you're at it, since you already noted the old GH_APP_ID_RELEASER secret is unreferenced, it'd be worth deleting it from the repo secrets as part of this change rather than leaving it as a post-merge TODO — keeps the secret surface tidy and avoids the "harmless leftover" drifting into confusion later.