ci: bump actions/create-github-app-token from 3.2.0 to 3.3.0

[dependabot]

Summary

Update the immutable GitHub App token action pin from 3.2.0 to 3.3.0 for rolling release pull requests.

Changes

• Pin actions/create-github-app-token to 64ab729a6294000f5aa4a4bc0b73d1f32bc45510.
• Retain the existing repository selection and explicit contents/pull-request write permissions.
• Upstream updates its supported permission inputs and bundled production dependencies.

Testing

• actionlint 1.7.12: passed.
• shellcheck docker/verify-container-compose.sh with ShellCheck 0.11.0: passed.
• zizmor --offline --strict-collection --min-severity medium --format github --config .github/zizmor.yml .github with zizmor 1.30.1: passed.
• git diff --check HEAD^ HEAD: passed.
• Current-head CI passed before this description update. A live release token was not created during local validation.

Risk and rollout

This action creates the existing repository-scoped release token, and its token creation, selected permissions and post-job revocation behavior were reviewed for compatibility. No application dependency or public CLI changes are included.

The upstream release was published on 2026-10-12 at 23:42:23 UTC. Do not merge before 2026-10-19 at 23:42:23 UTC, when the seven-day cooldown expires. Refresh the exact head, current CI and review requirements after eligibility.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T20:49:36.250998Z	c8cef5b	Manual request
🔒 Security Review	✅ Completed 2026-10-19T09:29:15.167754Z	c8cef5b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[mldangelo-oai]

Reviewed the immutable v3.3.0 pin, upstream permission-input changes, and the existing repository-scoped token configuration. The contents and pull-request permissions remain unchanged. Current-head CI is successful; no live release token was created during this review. No blocking code findings. The documented seven-day cooldown still expires at 2026-10-19 23:42:23 UTC.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: c8cef5b0d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🔵 Needs a closer look

The mandatory cooldown expires at 2026-10-19 23:42:23 UTC; refresh CI and review requirements after eligibility.

No open issues 🎉

What changed in this PR

Updates the GitHub App token action used by rolling release pull requests.

Changes:

• Bumps the immutable action pin from v3.2.0 to v3.3.0.
• Preserves repository selection and explicit write permissions.

File	Description
.github/​workflows/​node-release-pr.yml	Updates the release token action pin to v3.3.0.

_{Review effort: Balanced}