fix(publish): pass the release app private key to gh on stdin

[ttncode]

What this changes

set_release_secrets ran gh secret set RELEASE_APP_PRIVATE_KEY --body "$RELEASE_APP_PRIVATE_KEY", which put the GitHub App private key on argv. Any user on the host could read it through ps or /proc/<pid>/cmdline while the command ran.

The key now reaches gh on stdin. gh secret set --help documents this: --body … (reads from standard input if not specified). common/install.sh already passes the ghcr token to docker login --password-stdin the same way. RELEASE_APP_ID is not a secret and stays on --body.

For reference, immich (351be95) has no script that sets secrets. Its maintainers set them in the GitHub UI, and its workflows only read them.

How it was verified

• New test: tests/publish.bats "the release app private key reaches gh on stdin, never on argv". With --body it failed ([ "$output" = 0 ], the key was in the gh argv log), and with the fix it passes.
• Suite: bats tests/publish.bats passes 15/15.
• Lint: mise run lint passes.

Checklist

• mise run lint passes
• mise run test-runner passes — publish.bats is unit-lane; CI runs both lanes
• New behaviour has a test that fails without the change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes