chore(ENG-11425): replace semantic-release PAT with GitHub App tokens

[mstrisoline]

Description

• deploy-dev.yml — cut the tag/pre-release with the bt-version-tagger app: mint a token via actions/create-github-app-token (vars.GH_TAG_APP_ID + secrets.GH_APP_TAG_KEY) in the TAG environment (master-restricted) and pass it to github-tag-action + softprops. Drop the PAT from checkout.
• release.yml — mint a bt_semantic_release token (vars.SEMANTIC_RELEASE_APP_ID + the prod-env secrets.SEMANTIC_RELEASE_APP_PRIVATE_KEY) and use it for checkout + the git push origin HEAD:master write-back. npm OIDC publish stays on the native token.
• Removes all GH_SEMANTIC_RELEASE_PAT usage. Public repo, so no private composite action is referenced (inlined create-github-app-token).

Merge order: requires github-repository-management#441 (prod write-back key + new TAG env for this repo) applied first, and the bt-version-tagger + bt_semantic_release apps installed on this repo.

Business Impact

• Minimal

Testing required outside of automated testing?

• Not Applicable

Screenshots (if appropriate):

• Not Applicable

Rollback / Rollforward Procedure

• Roll Forward
• Roll Back

Documentation

ENG-11425

Reviewer Checklist

• Description of Change
• Description of Business Impact
• Description of outside testing if applicable
• Description of Roll Forward / Backward Procedure
• Documentation updated for Change

[ducktape-agents]

Review — 🟢 no issues found (0fee0be, Jul 1 8:33 PM UTC)