Fix release workflow ruleset bypass

[ntotten]

Summary

• generate the Integrations GitHub App token before checkout
• scope the token to both tools and www
• use the App token for checkout so release metadata and tag pushes authenticate as the ruleset bypass actor
• reuse the token for the existing downstream www dispatch

Fixes the protected-branch failure in release run 33181251265.

Verification

• ./scripts/sync-skill-metadata.sh --check
• python3 scripts/check-plugin-manifests.py
• ./scripts/build-release.sh https://github.com/zuplo/tools/releases/download/v-test
• parsed .github/workflows/release.yaml with Ruby YAML
• git diff --check

[Copilot]

Pull request overview

Updates the release workflow so protected-branch and tag pushes authenticate through the ruleset-bypass GitHub App.

Changes:

• Generates one App token for both tools and www.
• Reuses it for checkout, Git pushes, and downstream dispatch.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.