ci: require release please token

[codythatsme]

Summary

• use RELEASE_PLEASE_TOKEN directly for Release Please instead of falling back to GITHUB_TOKEN
• fail loudly if the secret is missing, rather than creating release PRs that cannot trigger required checks

Checks

• commit hook ran format, lint, and type check
• workflow YAML parsed locally