[pull] main from openai:main - #123

## Summary

- mint a repository-scoped installation token for the `openai-sdks`
GitHub App from environment configuration
- pass that token to Release Please and disable the release job's
built-in `GITHUB_TOKEN` permissions
- remove the manual workflow-dispatch workaround now that release branch
pushes and pull-request events trigger Actions normally
- keep API-key-backed example jobs off the automated Release Please
branch

## Why

Release Please currently authenticates with `GITHUB_TOKEN`. Events
created with that token do not normally start downstream workflows,
which required a separate dispatch job and release-specific workflow
inputs. A GitHub App installation token triggers the normal push and
pull-request workflows, so the workaround can be deleted.

## Repository configuration

- verified App: `openai-sdks` (App ID `3705508`, client ID
`Iv23li2AtcmhLHO07J87`)
- dedicated environment: `release`
- environment variable: `OPENAI_SDKS_APP_CLIENT_ID`
- environment secret: `OPENAI_SDKS_APP_PRIVATE_KEY`
- the environment is restricted to `main` and has no required-reviewer
or wait-timer gate

The `release` environment now contains both App credentials expected by
the workflow.

## Validation

- `./scripts/lint`
- `actionlint` v1.7.7 on the changed workflows
- `git diff origin/main...HEAD --check`