ci(release): pass the App's Client ID as a secret

[BrianEstrada]

Why

The shared bun-npm-release workflow now takes BriansBot's Client ID as a secret (BrianEstrada/.github#3), matching the RELEASE_APP_CLIENT_ID secret this repo already has. Until this merges, release.yml reads a vars.RELEASE_APP_CLIENT_ID that doesn't exist, so releases fail.

Approach

Pins the shared workflow to that merge commit (27f39c4) and passes the Client ID under secrets:.

Verification

actionlint passes. repo-defaults/apply.sh --check finds both RELEASE_APP_* secrets here.

[github-actions]

diffcop review

✅ All good

What we looked at

Read release.yml after the change: the input moves from with: to secrets:, and the shared-workflow SHA is pinned. I couldn't inspect the external workflow, so I couldn't check its input names or the pinned SHA.

Read (1): .github/workflows/release.yml

---

_{Reviewed c80023c · 8s · 1 tool call · 18.1K input tokens (79% cached) · 249 output · ~$0.02 run}