fix(release): mint the Homebrew tap token from the release-bot App

TAP_GITHUB_TOKEN was created before the org was renamed from Pythoughts-labs
to PyModel, so the tap clone succeeds (public repo, token unused for the read)
and only the push is refused. That broke the tap bump on 0.17.1 and 0.18.0.

The job now mints an installation token from pythinker-release-bot, scoped with
owner + repositories to homebrew-tap alone so it carries no write access to
pythinker-code. App tokens are minted per run and do not expire, which retires
this failure class rather than resetting its clock.

Author: elkaix

.changeset/use-app-token-for-brew-tap.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Use a scoped GitHub App token for Homebrew tap updates.

.github/workflows/release.yml

@@ -325,10 +325,20 @@ jobs:
         with:
           node-version-file: .nvmrc
 
+      - name: Mint tap token
+        id: tap-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+          owner: PyModel
+          repositories: homebrew-tap
+
       - name: Bump formula
         env:
-          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
+          TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
         run: |
+          # The token comes from the App installation, not a PAT.
           if [ -z "$TAP_GITHUB_TOKEN" ]; then
             echo "TAP_GITHUB_TOKEN secret not set — skipping tap update" >&2
             exit 0