feat: restore template vars for GitHub App customization (#1)

* feat: restore template vars for GitHub App customization

All upstream blockers resolved:
- common-repo/common-repo#235: source-declared template-vars passthrough (0.28.0)
- common-repo/common-repo#239: ${{ }} GHA expression collision fix (0.28.3)
- common-repo/common-repo#249: consumer override cache key fix (0.28.4)

Requires common-repo >= 0.28.4.

CI sync check skips release.yaml since src/ uses template vars
while top-level uses hardcoded christmas-island defaults.

Consumers can override GH App credentials:
```yaml
- repo:
    url: https://github.com/christmas-island/cr-semantic-release
    ref: v2.0.0
    with:
      - template-vars:
          GH_APP_ID_VAR: MY_APP_ID
          GH_APP_KEY_SECRET: MY_APP_KEY
          GH_APP_OWNER: my-org
```

* docs: document template-vars consumer overrides for GitHub App

Update README:
- Bump minimum common-repo version to 0.28.4
- Add 'Using a different GitHub App' section with override example
- Note release.yaml sync exception in repo structure

* fix: correct wagoid/commitlint-github-action pinned SHA for v6

The previous SHA b948419...cb3d was invalid (404 on GitHub API).
Updated to the actual v6 tag commit: b948419...f3ed.

* fix: rename commitlint.config.js to .cjs for ESM compatibility

wagoid/commitlint-github-action v6.2.1 runs with "type": "module"
in package.json, causing .js files to be treated as ESM. The
module.exports syntax requires CommonJS, so rename to .cjs.

---------

Co-authored-by: Jacob Alheid <shakefu@gmail.com>

src/.github/workflows/commitlint.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6

src/.github/workflows/release.yaml

@@ -32,9 +32,9 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
-          private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
-          owner: christmas-island
+          app-id: ${{ vars.${GH_APP_ID_VAR:-CHRISTMAS_ISLAND_APP_ID} }}
+          private-key: ${{ secrets.${GH_APP_KEY_SECRET:-CHRISTMAS_ISLAND_PRIVATE_KEY} }}
+          owner: ${GH_APP_OWNER:-christmas-island}
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0