feat: restore template vars for GitHub App customization (#1)

* feat: restore template vars for GitHub App customization

All upstream blockers resolved:
- common-repo/common-repo#235: source-declared template-vars passthrough (0.28.0)
- common-repo/common-repo#239: ${{ }} GHA expression collision fix (0.28.3)
- common-repo/common-repo#249: consumer override cache key fix (0.28.4)

Requires common-repo >= 0.28.4.

CI sync check skips release.yaml since src/ uses template vars
while top-level uses hardcoded christmas-island defaults.

Consumers can override GH App credentials:
```yaml
- repo:
    url: https://github.com/christmas-island/cr-semantic-release
    ref: v2.0.0
    with:
      - template-vars:
          GH_APP_ID_VAR: MY_APP_ID
          GH_APP_KEY_SECRET: MY_APP_KEY
          GH_APP_OWNER: my-org
```

* docs: document template-vars consumer overrides for GitHub App

Update README:
- Bump minimum common-repo version to 0.28.4
- Add 'Using a different GitHub App' section with override example
- Note release.yaml sync exception in repo structure

* fix: correct wagoid/commitlint-github-action pinned SHA for v6

The previous SHA b948419...cb3d was invalid (404 on GitHub API).
Updated to the actual v6 tag commit: b948419...f3ed.

* fix: rename commitlint.config.js to .cjs for ESM compatibility

wagoid/commitlint-github-action v6.2.1 runs with "type": "module"
in package.json, causing .js files to be treated as ESM. The
module.exports syntax requires CommonJS, so rename to .cjs.

---------

Co-authored-by: Jacob Alheid <shakefu@gmail.com>

.github/workflows/ci.yaml

@@ -16,7 +16,7 @@ jobs:
         run: |
           # Verify distributed files in src/ match the repo's own copies
           status=0
-          for file in .releaserc.yaml commitlint.config.js; do
+          for file in .releaserc.yaml commitlint.config.cjs; do
             if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
               echo "❌ $file differs from src/$file"
               diff --color "$file" "src/$file" || true
@@ -25,7 +25,7 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
-          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+          for file in .github/workflows/commitlint.yml; do
             if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
               echo "❌ $file differs from src/$file"
               diff --color "$file" "src/$file" || true
@@ -34,6 +34,8 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
+          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
+          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
           if [ $status -ne 0 ]; then
             echo ""
             echo "Top-level files and src/ are out of sync."

.github/workflows/commitlint.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6