Removes the Pixel CI check from this release branch in an attempt to
make CI green. Discussed with @aslilac and it is not worth the effort to
maintain and fix the Pixel CI checks on release branches, especially as
we continue development on the Pixel engine and service on main.

…8522) (#28525)

Cherry-pick of #28522 (`26de6140fb`) onto `release/2.35`.

Adds `CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC` /
`--disable-workspace-agent-context-sync`. When set, `PushContextState`
rejects agent context pushes with a dRPC `Unimplemented` code before any
validation or database work; deployed agents translate that into
`ErrPushUnimplemented` and stop their push loop for the life of the
connection. This gives large deployments a server-only kill switch for
context sync database write load, with no agent updates or workspace
restarts required.

Two conflicts resolved relative to the original commit:

- `coderd/workspaceagentsrpc.go`: `release/2.35` assigns
`ContextDirtyMarker: api.chatDaemon` directly (the nil-guarded local was
introduced later on `main`); kept the branch's form and added
`ContextSyncDisabled` alongside it.
- `docs/admin/setup/configuration-reference.md`: dropped; this generated
doc does not exist on `release/2.35`.

Validated on this branch: `go build`, `TestPushContextState` (unit),
`TestWorkspaceAgentPushContextState*` (end-to-end over real dRPC), CLI
and enterprise golden-file tests, full pre-commit hooks.

…5) (#28554)

Backport of #28553 to `release/2.35`.

## Change

Use a dedicated GitHub App token for the `Publish release` step:

- Add a `Generate release App token` step using `secrets.RELEASE_APP_ID`
/ `secrets.RELEASE_APP_PRIVATE_KEY`.
- Switch only that step's `GITHUB_TOKEN` to the minted App token.

## Required before merge (admin)

1. Create the release GitHub App (least privilege) and install it on
`coder/coder`.
2. Configure `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY`.
3. Add the App to the tag-create protection ruleset bypass list.

Refs coder/security-automation#297.