ci(workflows): verify client-id token generation at runtime and retire RELEASE_APP_ID

## Issue Description

After the `client-id` migration merges, confirm each affected workflow path mints a token successfully during its next normal execution, then remove the obsolete `RELEASE_APP_ID` Actions variable.

Depends on #2511 and #2512.

Do not trigger a stable or prerelease publication solely to test this. Observe naturally occurring, approved runs.

Runtime checkpoints:

- [ ] Next eligible `Pre-Release PR Update` push run validates `.github/workflows/release-prerelease-pr.yml`
- [ ] Next normal stable release run validates both token mints in `.github/workflows/release-stable.yml`
- [ ] Next normal merged prerelease PR validates `.github/workflows/release-prerelease.yml`

Acceptance criteria:

- [ ] All four token-generation call sites succeed using `RELEASE_APP_CLIENT_ID`
- [ ] No affected step reports the `app-id` deprecation warning
- [ ] Existing token consumers continue with no identity-related authentication failure
- [ ] Active repository workflow source contains no remaining `RELEASE_APP_ID` reference
- [ ] `RELEASE_APP_ID` is deleted from repository Actions variables
- [ ] `RELEASE_APP_CLIENT_ID` and `RELEASE_APP_PRIVATE_KEY` remain configured

## Additional Context

`RELEASE_APP_ID` is deliberately retained through the observation window as the rollback path. Delete it only after every checkpoint above passes.

If a runtime failure occurs, correct the repository variable configuration first. Reverting the workflow source is the last resort, not the first response.