fix: use GitHub App token instead of deploy key

[rgarcia]

Summary

Replace SSH deploy key authentication with kernel-internal GitHub App token for version bumping and publishing workflow.

Changes

• Add app token generation step using ADMIN_APP_ID and ADMIN_APP_PRIVATE_KEY secrets
• Replace ssh-key parameter in checkout with token parameter
• Update git identity to kernel-internal[bot] with proper numeric user ID
• Remove SSH URL setup (no longer needed with HTTPS token auth)

Benefits

• Consistent authentication method across all workflows
• Better auditability (app tokens show as bot user in commit history)
• Simplified credential management

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only authentication/identity changes; main risk is workflow failures if the new App secrets or token permissions are misconfigured.

Overview
Updates the publish.yml workflow to authenticate git operations using a GitHub App token instead of an SSH deploy key by adding an actions/create-github-app-token step and passing its token to actions/checkout.

Commits from the version bump now use the kernel-internal[bot] identity, and the workflow removes the SSH remote rewrite since pushes go through the HTTPS token flow.

^{Written by Cursor Bugbot for commit d866d3a. This will update automatically on new commits. Configure here.}