fix(PR-67): correct token reference and step order in plugin-release

- Move Generate GitHub App token before Create GitHub Release step
- Change GITHUB_TOKEN env var from secrets.GITHUB_TOKEN (not injected by Gitea runners)
  to steps.app-token.outputs.token

Refs: PRI-1702

.github/workflows/plugin-release.yaml

@@ -310,6 +310,13 @@ jobs:
           git push origin "$BRANCH"
           git push origin "refs/tags/v${VERSION}"
 
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
@@ -318,14 +325,7 @@ jobs:
           fail_on_unmatched_files: false
           generate_release_notes: true
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Install GitHub CLI
         run: |