ci: use GitHub app token for 0.x releases instead of PAT (FB-4891)

[fstr]

Summary

Replaces RELEASE_PAT with a short-lived token from the fireboltdb-ci-writer GitHub App in the 0.x release workflow. This is the same change already merged on the default branch.

Both release.yml and release-v0.yml on this branch used the PAT. release.yml also gets main-branch: 0.x: it relied on the default main, so its version-bump push would fail from a 0.x checkout.
RELEASE_PAT is being removed. This keeps the 0.x release line close to working if we ever need another release from it.

Not tested: no 0.x release is planned. The workflow also has other old problems (e.g. old action versions and runtimes) that this PR doesn't touch.

Part of FB-4891.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only credential and workflow wiring changes; no application runtime or customer-facing behavior.

Overview
Replaces long-lived RELEASE_PAT with a short-lived GitHub App token from fireboltdb-ci-writer in both release.yml and release-v0.yml. Each publish job now runs actions/create-github-app-token (pinned to v3.2.0) with GH_APP_FB_DB_CI_WRITER_* secrets and permission-contents: write, then passes steps.app-token.outputs.token to actions/checkout instead of the PAT.

release.yml also sets main-branch: 0.x on firebolt-db/action-python-release, so version-bump pushes target the 0.x line rather than the action’s default main when releasing from that branch.

^{Reviewed by Cursor Bugbot for commit 5db310a. Bugbot is set up for automated code reviews on this repo. Configure here.}