fix: remove incorrect excludes and inherit all upstream-owned files

The upstream repo's src/ defines what gets distributed — all of those
files should be inherited. Override template vars for christmas-island
credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.common-repo-upstream.yaml

@@ -3,14 +3,8 @@
     url: https://github.com/common-repo/cr-upstream-repo
     ref: v1
 
-- exclude:
-    # cr-semantic-release owns these — don't inherit from upstream
-    - ".releaserc.yaml"
-    - "commitlint.config.cjs"
-    - "src/commitlint.config.cjs"
-    - ".github/workflows/release.yaml"
-    - ".github/workflows/commitlint.yml"
-    # Upstream docs/metadata not relevant
-    - "CHANGELOG.md"
-    - "LICENSE"
-    - "README.md"
+# Override upstream template vars for christmas-island
+- template-vars:
+    GH_APP_ID_SECRET: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island

.github/workflows/commitlint.yml

@@ -14,7 +14,8 @@ jobs:
     name: Lint Commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
+
+      - uses: wagoid/commitlint-github-action@v6

.github/workflows/release.yaml

@@ -30,21 +30,24 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ secrets.CHRISTMAS_ISLAND_APP_ID }}
           private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
           owner: christmas-island
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           cache-dependency-path: ".releaserc.yaml"
           node-version: lts/*
+
       - name: Semantic Release
         id: release
         run: |