fix(ci): expose package publish token to release jobs

[alexk-dev]

Summary

• expose GITHUB_TOKEN and GH_TOKEN at the release job level for both automatic and manual release workflows
• keep GitHub Packages publish and gh release creation on the same credentials model

Root cause

actions/setup-java generated Maven server credentials referencing GITHUB_TOKEN, but the manual Release Plugin workflow did not actually expose that env var in the Publish GitHub Package step. The release payload built successfully, but maven-deploy-plugin:deploy-file failed with 401 Unauthorized when publishing to maven.pkg.github.com.

What changed

• add job-level GITHUB_TOKEN and GH_TOKEN to .github/workflows/release-plugin.yml
• move the same token wiring to the release_main job level in .github/workflows/ci.yml for consistency

Verification

• reproduced the failure on manual Release Plugin for golemcore/telegram
• confirmed the build path reaches package publication and the failure is specifically auth-related (401 Unauthorized)
• workflow diff only changes token exposure; no plugin code or release logic was changed