[uk-ai-resilience] GitHub App token minting for release workflow added and reverted without documented security sign-off (Tier C [Content truncated

### Summary

A GitHub App token minting change for the release workflow was merged and reverted within the same 7-day lookback window with no visible external security-review artifact referenced in either commit:

- Added: "Add GitHub App token minting for release workflow" (#60214)
- Reverted: "Revert \"Add GitHub App token minting for release workflow\"" (#60218)

Credential-minting changes to release automation are a high-sensitivity surface (they can affect what scope of write access an automated release process holds). Shipping and reverting such a change in the same window, without a documented security sign-off note in either PR, is a control gap even though the outcome (revert) was itself a good rollback-readiness signal.

### Tier: C — Restricted Pending Review

| Dimension | Rating |
|---|---|
| Exposure amplification | Medium |
| Patchability | High |
| Detectability | Medium (only visible via commit/PR history, not an automated scanner alert) |
| Operational fragility | Medium |
| Ownership confidence | Medium |
| **Overall** | **Medium** |

### Remediation action

- Document the reason for the revert (e.g. in a follow-up PR description or changeset) and require an explicit security sign-off note before re-attempting App-token minting for the release workflow.
- Confirm no lingering App token minting configuration remains partially wired after the revert.

**SLA urgency**: High — before the next attempt to re-introduce this change.

### Discussion report

See "UK AI Governance: recent-change risk review (2026-09-04 to 2026-09-11)" discussion created by this run for full asset graph, tier classification, and remediation queue context.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34616396413) · copilot · auto · 92.2 AIC · ⌖ 12.7 AIC · ⊞ 8.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start with PRs #60214 and #60218 and the “UK AI Governance: recent-change risk review (2026-09-04 to 2026-09-11)” discussion. Inspect the release workflow and commit history for any remaining App-token minting configuration, then document the revert reason and the required explicit security sign-off before another attempt.

Written by the indexing model from the issue text.