Standardize checkout-as-app in cd.yaml and release.yaml

[nsheaps]

What changed

• .github/workflows/cd.yaml (bump-and-update-marketplace job): merged the separate actions/checkout@v7 (fetch-depth: 0) + local ./.github/actions/github-app-auth composite steps into the single centralized nsheaps/github-actions/.github/actions/checkout-as-app action (pinned SHA, same one already used in this repo's own test.yaml lint job and in nsheaps/ai-mktpl), keeping fetch-depth: '0' and the existing id: auth.
• .github/workflows/release.yaml (release job): same conversion.
• release.yaml's update-homebrew job is left untouched — a "Get job context" step sits between its checkout and auth steps, so merging would require reordering beyond this fix's scope (same precedent followed for the analogous update-homebrew job in nsheaps/dotfiles and nsheaps/claude-utils). The local ./.github/actions/github-app-auth composite therefore stays in place, still referenced there.
• test.yaml's lint job already correctly used the centralized action — untouched.

These workflow files are not part of the org's active file-sync (ansible/config/sync-files.yml), so this fix is made directly in this repo.

Note on scope/timing

This was delayed by a coordination pause with a sibling session ("Review workflow setup across repos") that also has open PRs against this repo (#318, touching plugins/claude-code/review-utils/* and templates/dispatch-review.yaml/deployed dispatch-review.yaml). Verified zero file overlap between that PR and this one before proceeding.

---

Generated by Claude Code

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action

[nsheaps]

CI red on test — investigated. The failure is in @nsheaps/agents-plugins:test ("Error: claude native binary not installed... postinstall did not run"), unrelated to this PR's auth-mechanism changes in cd.yaml/release.yaml (this PR doesn't touch package.json, install steps, or test.yaml at all).

Confirmed pre-existing: test.yaml has been failing on main consistently since at least Aug 7 (e.g. runs a309dff2, f2e9114d, f7080ec0, 6053b798), predating this PR. Not fixing it here — out of scope; will re-check once main's test workflow recovers. The version-preview bot comment above is expected/automated, no action needed.

---

Generated by Claude Code

---

Generated by Claude Code