ci(workflows): verify client-id token generation at runtime and retire RELEASE_APP_ID

[jkim323]

Issue Description

After the client-id migration merges, confirm each affected workflow path mints a token successfully during its next normal execution, then remove the obsolete RELEASE_APP_ID Actions variable.

Depends on #2511 and #2512.

Do not trigger a stable or prerelease publication solely to test this. Observe naturally occurring, approved runs.

Runtime checkpoints:

• Next eligible Pre-Release PR Update push run validates .github/workflows/release-prerelease-pr.yml
• Next normal stable release run validates both token mints in .github/workflows/release-stable.yml
• Next normal merged prerelease PR validates .github/workflows/release-prerelease.yml

Acceptance criteria:

• All four token-generation call sites succeed using RELEASE_APP_CLIENT_ID
• No affected step reports the app-id deprecation warning
• Existing token consumers continue with no identity-related authentication failure
• Active repository workflow source contains no remaining RELEASE_APP_ID reference
• RELEASE_APP_ID is deleted from repository Actions variables
• RELEASE_APP_CLIENT_ID and RELEASE_APP_PRIVATE_KEY remain configured

Additional Context

RELEASE_APP_ID is deliberately retained through the observation window as the rollback path. Delete it only after every checkpoint above passes.

If a runtime failure occurs, correct the repository variable configuration first. Reverting the workflow source is the last resort, not the first response.