feat(build): integrate release-please bot with GitHub App auth and CI gating

[WilliamBerryiii]

Description

Consolidated release-please automation into the main CI pipeline with GitHub App authentication, CI gating, and a two-stage release workflow (draft then publish).

• Merged release-please into main.yml as a new release-please job gated behind all 6 CI jobs (spell-check, markdown-lint, table-format, psscriptanalyzer, link-lang-check, markdown-link-check)
• Added publish-release job that promotes draft releases to published when release_created is true
• Switched authentication from GITHUB_TOKEN with contents: write / pull-requests: write to GitHub App token via actions/[email protected] with least-privilege contents: read
• Upgraded release-please-action from v4.1.0 to v4.4.0 (SHA-pinned)
• Enabled draft mode, increased release-search-depth to 800 and commit-search-depth to 1000 in release-please-config.json
• Replaced plain-text changelog section headers with emoji-prefixed headers
• Deleted standalone release-please.yml workflow
• Added (build) to allowed commit scopes in commit-message.instructions.md

Closes #138

Type of Change

• 🐛 Bug fix (non-breaking change fixing an issue)
• ✨ New feature (non-breaking change adding functionality)
• 💥 Breaking change (fix or feature causing existing functionality to change)
• 📚 Documentation update
• 🏗️ Infrastructure change (Terraform/IaC)
• ♻️ Refactoring (no functional changes)

Component(s) Affected

• deploy/000-prerequisites - Azure subscription setup
• deploy/001-iac - Terraform infrastructure
• deploy/002-setup - OSMO control plane / Helm
• deploy/004-workflow - Training workflows
• src/training - Python training scripts
• docs/ - Documentation

Testing Performed

• Terraform plan reviewed (no unexpected changes)
• Terraform apply tested in dev environment
• Training scripts tested locally with Isaac Sim
• OSMO workflow submitted successfully
• Smoke tests passed (smoke_test_azure.py)

Checklist

• My code follows the project conventions
• Commit messages follow conventional commit format
• I have performed a self-review
• Documentation updated as needed
• No new linting warnings introduced

Notes

• The release-please job requires a GitHub App registered with Contents (R/W), Pull Requests (R/W), and Metadata (R) permissions. Configure RELEASE_APP_ID as a repository variable and RELEASE_APP_PRIVATE_KEY as a repository secret before merging.
• The publish-release job uses GITHUB_TOKEN with contents: write to flip the draft flag — no App token needed for this step.
• No Component(s) Affected or Testing Performed checkboxes apply to this workflow-only change.
• The removed if guard from the old workflow (!startsWith(...)) is intentionally not carried forward; release-please handles duplicate-release prevention internally.

🚀 - Generated by Copilot

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/release-please.yml

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.