ci: use new gh app for pr bypass when publishing

[jakehobbs]

---

PR-Codex overview

This PR updates the .github/workflows/publish-package.yml workflow to generate a GitHub app token dynamically instead of using a static personal access token. This enhances security by leveraging GitHub's app authentication.

Detailed summary

• Added a step to generate an app token using actions/create-github-app-token@v1.
• Set the app-id and private-key using secrets.
• Replaced the static token with the generated token from the app token step in the checkout process.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[Copilot]

Pull request overview

This PR updates the package publishing workflow to use a dynamically generated GitHub App installation token instead of a long-lived personal access token, improving credential security for repository writes during publish.

Changes:

• Added a step to generate a GitHub App token via actions/create-github-app-token@v1.
• Switched actions/checkout authentication to use the generated app token output.