ci(release): mint the publish token with workflows:write (#1787)

## What

The v1.3.3 publish failed with `403 Resource not accessible by
integration` on knope's `POST /releases`. Renovate merged a
`.github/workflows` change to `main` (PR 1785) between the release-PR
merge and the publish job. knope sends the checked-out release commit as
`target_commitish`. That commit's workflow files then differ from
`main`, and GitHub refuses to create the tag without the Workflows
permission. A manual `workflow_dispatch` on the `main` tip published
v1.3.3 with the unchanged token, which confirms the cause.

The maintainer granted the clauster-ci App "Workflows: Read and write".
This PR adds `permission-workflows: write` to the `app-token` mint in
the `release` job, moves that mint to the end of the job, and corrects
the nearby comments.

Risk: the token reaches only the verify step's `if:` and `knope
release`. knope's `release` workflow has one `Release` step and no
`Command` steps, and the job runs no `git push`. A compromised
SHA-pinned action that runs after the mint could in theory use the wider
scope to push a workflow. The token lives for one hour at most and is
revoked at job end. To shrink that window, the second commit moves the
mint and its empty-token check to just before "Create + publish the
GitHub release", after the download, attest, Sigstore and knope-install
steps. The cost: a broken secret now fails after signing instead of
before it. Nothing publishes in either case.

## Checklist

- [x] PR title follows Conventional Commits.
- [x] `no-changelog` label applied (CI only).
- [x] Tests: not applicable, workflow-only change. `uvx zizmor` reports
no findings and `actionlint` with shellcheck passes.
- [x] Docs: no user-facing behavior or config change.
- [x] `just check` and the pre-commit hooks pass locally.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Schuby <12485317+schubydoo@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: schubydoo

.github/workflows/knope-release.yml

@@ -106,25 +106,6 @@ jobs:
       id-token: write # Sigstore keyless signing (OIDC)
       attestations: write # actions/attest records SLSA build provenance
     steps:
-      - name: Mint GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ secrets.CLAUSTER_CI_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CLAUSTER_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-      # Fail LOUD on an empty mint: knope uses this token to create the GitHub
-      # Release and push the tag, and an App-identity tag is what lets the publish
-      # trigger downstream automation. An empty token would degrade to GITHUB_TOKEN
-      # (whose tag push does not re-trigger workflows) or fail confusingly. Surface
-      # it here. (See issue #509.)
-      - name: Verify App token was minted
-        if: ${{ steps.app-token.outputs.token == '' }}
-        run: |
-          echo "::error::clauster-ci App token mint produced an empty token; \
-          refusing to proceed. Check the CLAUSTER_CI_APP_CLIENT_ID / \
-          CLAUSTER_CI_APP_PRIVATE_KEY secrets and the clauster-ci App installation."
-          exit 1
       # Check out the squash commit that landed on main (merge_commit_sha), NOT the
       # orphaned PR-head — knope must tag a commit that is actually on main. Full
       # history + tags so knope can compare the bumped version against the last
@@ -257,9 +238,9 @@ jobs:
           echo "staged $(find dist/release-assets -type f | wc -l) assets for v${VERSION}"
       # A SEPARATE, read-only mint for the third-party download step. The binary
       # fetch needs public read only, so it must not carry the app-token's
-      # contents:write scope (this job also holds id-token:write for Sigstore).
-      # Same secrets as that mint, so the earlier "Verify App token was minted"
-      # step already fails the job loud if they are broken.
+      # contents:write and workflows:write scopes (this job also holds
+      # id-token:write for Sigstore). It uses the same secrets as the app-token
+      # mint below, and create-github-app-token fails the step if they are broken.
       - name: Mint download-scoped GitHub App token
         id: download-token
         uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
@@ -277,6 +258,35 @@ jobs:
           # was exhausted by concurrent runs and 403'd the same release-asset fetch
           # in knope-prepare on 2026-09-03. The same limit can stop a publish here.
           github-token: ${{ steps.download-token.outputs.token }}
+      # The write-scoped App token for knope. Minted LAST, after the third-party
+      # download, attest, Sigstore and knope-install steps, so the contents:write +
+      # workflows:write token exists only while knope runs.
+      - name: Mint GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ secrets.CLAUSTER_CI_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CLAUSTER_CI_APP_PRIVATE_KEY }}
+          permission-contents: write
+          # knope tags the checked-out release commit. If main moved on with a
+          # .github/workflows change before this job ran, that commit's workflow
+          # files differ from main. GitHub then refuses POST /releases, the call
+          # that creates the tag (403 "Resource not accessible by integration"),
+          # unless the token carries workflows:write.
+          # Seen on v1.3.3, 2026-11-02.
+          permission-workflows: write
+      # Fail LOUD on an empty mint: knope uses this token to create the GitHub
+      # Release and push the tag, and an App-identity tag is what lets the publish
+      # trigger downstream automation. An empty token would degrade to GITHUB_TOKEN
+      # (whose tag push does not re-trigger workflows) or fail confusingly. Surface
+      # it here. (See issue #509.)
+      - name: Verify App token was minted
+        if: ${{ steps.app-token.outputs.token == '' }}
+        run: |
+          echo "::error::clauster-ci App token mint produced an empty token; \
+          refusing to proceed. Check the CLAUSTER_CI_APP_CLIENT_ID / \
+          CLAUSTER_CI_APP_PRIVATE_KEY secrets and the clauster-ci App installation."
+          exit 1
       # knope creates the draft, uploads dist/release-assets/*, and publishes. The
       # App token (not GITHUB_TOKEN) is what lets the published tag trigger
       # release.yml. If the version already matches the latest release tag (e.g. a