ci: approve release bump PR via a least-privilege GitHub App

[helly25]

Problem

trigger_release.sh tried to approve and admin-merge its own version-bump PR with one identity. GitHub rejects self-approval, and the main ruleset blocks it anyway: require_last_push_approval: true, required_approving_review_count: 1, and bypass_actors: [] / can_bypass: never (so --admin can never override). The result was a pushed release tag plus a stuck, unmergeable PR.

Approach — a dedicated GitHub App approves (no bypass)

The App's only power is pull_requests:write (+ metadata:read). It satisfies the required review as a second identity rather than bypassing anything, so main keeps full protection and no human or token holds a standing override. (Chosen over a bypass_actors entry precisely to avoid any standing override existing.)

• Admin gate — only a repo admin may run a release (checked via their own gh auth first).
• Config from Actions variables — RELEASE_APP_ID, RELEASE_APP_INSTALLATION_ID, RELEASE_APP_KEY_SERVICE are read from the repo's Actions variables (env overrides), so nothing is hard-coded and the script is reusable.
• Identity split — create/push/merge run as the human; a short-lived App installation token (RS256 JWT via openssl) authenticates only the approval, so approver ≠ last pusher.
• Fail-fast preflight — all config is validated and an installation token is minted before any irreversible step, so a misconfig can't strand a pushed tag.
• --dry — runs every check (incl. the App preflight) and prints the plan, changing nothing.
• The PEM is stored raw in the Keychain; the script uses it verbatim or hex-decodes it on read (macOS security -w hex-encodes any secret containing newlines).

Verified

./tools/trigger_release.sh --dry 0.4.3 reaches App credential preflight: ok (installation token mints). — token mints, permissions are exactly {"metadata":"read","pull_requests":"write"}, installed on helly25/bzl only — then correctly stops at the pre-existing "clean main" guard (run from a feature branch).

Not yet proven (only observable on a real PR): that the App's approval counts toward the required review. First real release — or a throwaway PR — confirms it; fallback is a bypass_actors entry for the App.

Test plan

• shellcheck + beautysh clean.
• App-credential preflight succeeds (token mint, scoped perms, repo install).
• ./tools/trigger_release.sh --dry <version> reaches [dry-run] All checks passed from a clean main after merge.

🤖 Generated with Claude Code