feat: restore template vars for GitHub App customization

All upstream blockers resolved:
- common-repo/common-repo#235: source-declared template-vars passthrough (0.28.0)
- common-repo/common-repo#239: ${{ }} GHA expression collision fix (0.28.3)
- common-repo/common-repo#249: consumer override cache key fix (0.28.4)

Requires common-repo >= 0.28.4.

CI sync check skips release.yaml since src/ uses template vars
while top-level uses hardcoded christmas-island defaults.

Consumers can override GH App credentials:
```yaml
- repo:
    url: https://github.com/christmas-island/cr-semantic-release
    ref: v2.0.0
    with:
      - template-vars:
          GH_APP_ID_VAR: MY_APP_ID
          GH_APP_KEY_SECRET: MY_APP_KEY
          GH_APP_OWNER: my-org
```

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
-          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+          for file in .github/workflows/commitlint.yml; do
             if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
               echo "❌ $file differs from src/$file"
               diff --color "$file" "src/$file" || true
@@ -34,6 +34,8 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
+          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
+          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
           if [ $status -ne 0 ]; then
             echo ""
             echo "Top-level files and src/ are out of sync."