ci: use app to push release changes

This allows bypassing branch protection.
See https://github.com/orgs/community/discussions/25305#discussioncomment-8256560

.github/workflows/ci.yml

@@ -30,17 +30,24 @@ jobs:
         run: yarn lint
 
   release:
+    needs: lint
     runs-on: ubuntu-latest
     permissions:
       contents: write # to be able to publish a GitHub release
       issues: write # to be able to comment on released issues
       pull-requests: write # to be able to comment on released pull requests
       id-token: write # to enable use of OIDC for npm provenance
     steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.SEMANTIC_RELEASE_APP_ID }}
+          private-key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
       - name: Enable Corepack
         run: corepack enable
       - name: Setup Node.js