[SandObserver]

Summary

• Authenticate ca-template-changes.yml as the release app instead of GITHUB_TOKEN, so the template pull request it opens starts its checks.
• Drop that workflow's contents: write and pull-requests: write to permissions: {}, and remove the matching entry from the workflow permission allow-list.
• Extend the release automation tests to cover the template workflow's token and permissions.
• Document creating the release GitHub App in docs/releasing.md: permissions, private key, installation, and the two secret names.

Testing
All green. Extended 2 existing tests to the template workflow.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.