The Publish draft release step used the workflow's default GITHUB_TOKEN,
which does not return draft releases from listReleases — so the script
failed with "Draft release for vX.Y.Z not found" and every release tag
had to be undrafted manually.

This same bug was fixed once before in 4db55ac ([ci] Add Github
token to fetch draft releases) by adding github-token: GH_PAT to the
listing step. It was lost during the refactor in 66a756b that combined
the separate listing/flags/publish steps into a single Publish step,
and not restored when f96b2da migrated remaining github-token usages
from GH_PAT to the cozystack-ci App token.

Add github-token: app-token.outputs.token to the merged step so it
shares the same auth as the rest of the workflow.

Assisted-By: Claude <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>
(cherry picked from commit 7d2fe2f)
(cherry picked from commit 70e8f84)