fix: repair release and publish workflows

[LonelyCpp]

Summary

• pin pnpm 11.19.0 so the publish workflow can initialize pnpm
• configure the GitHub Packages token in pnpm trusted user config
• replace the Release Please PAT with an org-wide GitHub App installation token

Verification

• pnpm install --frozen-lockfile
• pnpm run build
• pnpm publish --dry-run --no-git-checks
• parsed all workflow YAML files
• git diff --check