ci(workflows): migrate release GitHub App token steps from app-id to client-id

## Issue Description

All four active `actions/create-github-app-token` invocations in the release workflows still use the deprecated `app-id` identity input. Migrate every call site to the `client-id` contract in a single coordinated cutover, with no compatibility fallback and no mixed contract left behind.

Scope is limited to the identity input and the adjacent version comment. Everything else stays byte-for-byte identical.

Files and call sites:

- `.github/workflows/release-stable.yml` — two steps (around lines 193-196 and 283-286)
- `.github/workflows/release-prerelease.yml` — one step (around lines 32-35)
- `.github/workflows/release-prerelease-pr.yml` — one step (around lines 32-35)

Required edit at each of the four call sites:

- Replace `app-id: ${{ vars.RELEASE_APP_ID }}` with `client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}`
- Correct the trailing pin comment from `# v2.0.0` to `# v3.2.0` (the pinned SHA is v3.2.0; the comment is wrong today)
- Preserve `actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1` exactly
- Preserve `private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}`
- Add no other action inputs

Acceptance criteria:

- [ ] Active `.github/workflows/` files contain zero `app-id:` matches and zero `vars.RELEASE_APP_ID` matches
- [ ] Active `.github/workflows/` files contain exactly four `client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}` matches for `actions/create-github-app-token`
- [ ] All four affected pin comments read `# v3.2.0`
- [ ] No action SHA, private-key reference, `permissions` input, `owner`/`repositories` input, token consumer, or unrelated workflow line is modified
- [ ] The final diff touches only the three workflow files listed above

## Additional Context

Blocked by: the repository Actions variable `RELEASE_APP_CLIENT_ID` must exist and be verified against the release GitHub App before this change enters a pull request. That configuration work is being handled separately and is not part of this issue.

Notes:

- `RELEASE_APP_ID` stays in place during the migration window for rollback; retirement is tracked in a follow-up issue.
- `RELEASE_APP_PRIVATE_KEY` is unchanged and remains a repository secret.
- Never place the Client ID value in source, commits, logs, or PR text. Reference it only by variable name.
- Out of scope: release-token permission narrowing, repository-scope hardening, revocation defaults, and any release-behavior change.
- The three steps are independent and can be split across parallel work, but should land as one PR so no deprecated contract remains in `main`.