The release workflow uses a GitHub App (rather than the default GITHUB_TOKEN)
because it must bypass branch protection to push the version-bump commit and
tag to master, publish to another repository, and trigger a downstream repo.
The default GITHUB_TOKEN cannot do these things.
- Create the App. Go to the organization's Settings → Developer settings → GitHub Apps → New GitHub App (an org-owned App is recommended over a personal one so ownership survives