fix: use organization app variable and targeted release fetch

[vitormattos]

Aligns release automation with the organization-level credential contract and avoids fetching every repository branch during release preparation.

• reads LIBRECODE_WORKFLOW_APP_ID from Actions variables and the private key from Actions secrets;
• keeps early credential validation but reports the correct variable/secret locations;
• checks out the selected release ref shallowly, then fetches only the selected stable branch history plus tags required by release-tool;
• applies the same targeted history fetch after merging a generated release PR;
• keeps publication verification shallow because it only needs the published tag/config and restored release state;
• restores the workflow updater to the same variable/secret contract;
• bumps the workflow platform to 0.6.3.