feat: restore template vars for GitHub App customization

All upstream blockers resolved:
- common-repo/common-repo#235: source-declared template-vars passthrough (0.28.0)
- common-repo/common-repo#239: ${{ }} GHA expression collision fix (0.28.3)
- common-repo/common-repo#249: consumer override cache key fix (0.28.4)

Requires common-repo >= 0.28.4.

CI sync check skips release.yaml since src/ uses template vars
while top-level uses hardcoded christmas-island defaults.

Consumers can override GH App credentials:
```yaml
- repo:
    url: https://github.com/christmas-island/cr-semantic-release
    ref: v2.0.0
    with:
      - template-vars:
          GH_APP_ID_VAR: MY_APP_ID
          GH_APP_KEY_SECRET: MY_APP_KEY
          GH_APP_OWNER: my-org
```

.common-repo.yaml

@@ -3,5 +3,11 @@
     - "src/**"
     - "src/.*"
     - "src/.*/**"
+- template:
+    - "src/.github/workflows/release.yaml"
+- template-vars:
+    GH_APP_ID_VAR: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island
 - rename:
     - "^src/(.*)$": "$1"

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
-          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+          for file in .github/workflows/commitlint.yml; do
             if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
               echo "❌ $file differs from src/$file"
               diff --color "$file" "src/$file" || true
@@ -34,6 +34,8 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
+          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
+          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
           if [ $status -ne 0 ]; then
             echo ""
             echo "Top-level files and src/ are out of sync."

src/.github/workflows/release.yaml

@@ -32,9 +32,9 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ vars.${GH_APP_ID_VAR:-CHRISTMAS_ISLAND_APP_ID} }}
-          private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
+          private-key: ${{ secrets.${GH_APP_KEY_SECRET:-CHRISTMAS_ISLAND_PRIVATE_KEY} }}
-          owner: christmas-island
+          owner: ${GH_APP_OWNER:-christmas-island}
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0