chore(ci): apply review — scope app-token secret names, use vars for client-id

Author: amondnet

.github/workflows/release-please.yml

@@ -37,8 +37,9 @@ jobs:
         id: app-token
         with:
           # client-id is the recommended input (supersedes the legacy app-id).
-          client-id: ${{ secrets.CLIENT_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
+          # client-id is a public identifier -> repo/org variable; only the key is secret.
+          client-id: ${{ vars.RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: googleapis/release-please-action@v4
         id: release