What changed

Fixes a 401 "JSON web token could not be decoded" error in the new App-token release flow. The Resolve bot identity step previously called gh api /app to fetch the App's slug, but that endpoint requires a GitHub App JWT (signed with the private key) — not the installation access token the workflow has. Switching to the action's own app-slug output avoids the privileged endpoint entirely.

Technical Context

• The actions/create-github-app-token action exposes app-slug as a step output; using it removes the need to query the API for it
• The remaining gh api /users/<slug>%5Bbot%5D call is fine — that endpoint accepts installation tokens
• Verified by inspecting the action's action.yml outputs schema (token, installation-id, app-slug)

Test plan

After merge, redispatch:

gh workflow run release-prepare.yml -f bump_kind=patch -f dry_run=false

Expect Job 2's Resolve bot identity step to print outputs cleanly and the rest of Job 2 to push the bump + tag through the bypass.