What changed

Two small follow-ups from the App-token rollout:

1. Renamed the misleading "Re-validate after approval wait" step → "Verify state still matches plan from Job 1". The approval gate this referred to was removed in General: Restore two-step release approval flow #565, but the step name still implied one. Step body unchanged.
2. Switched app-id → client-id on actions/create-github-app-token. app-id is deprecated upstream (warning printed on every run); client-id is the supported input now.

Action required before merging

The client-id swap requires a new org secret. Steps:

1. Open https://github.com/organizations/d4rken-org/settings/apps/d4rken-org-releaser (or whatever your App's name is)
2. Copy the Client ID value (it's in the "About" section near the App ID; format is Iv1.<hex> or similar)
3. Add an org Actions secret RELEASE_APP_CLIENT_ID with that value, scoped the same way as RELEASE_APP_ID (selected repos: capod, or all)
4. Then merge this PR
5. After successful first run, the old RELEASE_APP_ID secret can be deleted

Technical Context

• client-id and app-id identify the same App but in different formats. The action accepts either; only client-id is non-deprecated.
• Renamed the adjacent "Re-check tag collision (state may have moved during approval)" step to drop the obsolete approval-wait reference too.