Context

The 2.35.5-snapshot release workflow still uses the retired QAMETA_CI secret. The attempted 2.35.6 release reached actions/checkout and failed because the secret produced an empty token, before the workflow could create the release tag or GitHub release.

This backports the current release authentication flow from main. The workflow creates a GitHub App installation token from the existing ALLURE_CI_APP_CLIENT_ID repository variable and ALLURE_CI_APP_PRIVATE_KEY secret, uses that token for checkout, pushes, and GitHub release creation, and configures the commit author from ALLURE_CI_APP_USER_ID and ALLURE_CI_APP_SLUG. Creating the release with an App token preserves the release event that starts the publish workflow.

The publish workflow is also aligned with main by updating actions/checkout to v7 and actions/setup-java to v6. Both workflow files match their current main versions. They parse as valid YAML, and git diff --check passes. No unit tests are added because the change only backports GitHub Actions configuration.

Checklist

• Sign Allure CLA
• Provide unit tests