chore(release): fix ci pipeline in general, and applies previous PR creates v0.16.3

[raederan]

Summary

• Fixes the release job failing with GH013 (default GITHUB_TOKEN cannot push to PR-protected main).
• Adds actions/create-github-app-token step (RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY).
• Uses that app token for actions/checkout (the push) and as GH_TOKEN for semantic-release.
• App oold-release-bot is on the ruleset bypass, so PSR can push the release commit + tag.
• Token is short-lived, scoped to Contents: write, minted per run.
• No change when there is no version bump (release stays skipped).
• Ruleset cleanup: removed the Write-role bypass, only the app bypasses now.

[github-actions]

Release preview

Merging this PR would release v0.16.3 (current: v0.16.2).

Changelog preview (truncated)

## v0.16.3 (2026-07-29)

### Bug Fixes

- Correct resolve_iri typo to resolve_iris in WikiDataSparqlResolver
  ([`d04108a`](https://github.com/OO-LD/oold-python/commit/d04108abb74387a1af1aea9db62e4eac1298a722))

- Restore tag-push release trigger; rewrite CONTRIBUTING for clarity and brevity
  ([`1b3436b`](https://github.com/OO-LD/oold-python/commit/1b3436b545b933520c8ea2cf7dc099635218ddce))

- **ci**: Disable uv cache in benchmark job to prevent post-step failure
  ([`c5873ed`](https://github.com/OO-LD/oold-python/commit/c5873edb6b3a39f43a5281a543cd62268e26b7f8))

- **ci**: Use git worktree for baseline benchmarks to avoid branch switch
  ([`5139d76`](https://github.com/OO-LD/oold-python/commit/5139d76e0f0a4a634d6426fe7a3edd94c86c99fd))

### Build System

- Map module names for optional UI extras to silence deptry warnings
  ([`d963a13`](https://github.com/OO-LD/oold-python/commit/d963a13265c07084782ffeb2cf9dcfb8bda228f3))

- Migrate from pyscaffold/setuptools to hatchling + uv tooling
  ([`9ce1f13`](https://github.com/OO-LD/oold-python/commit/9ce1f1335b9f408c837d88a54d92b65b0527e6b0))

### Chores

- Authorship for zenodo releases through CITATION.cff file; Guideline on contributing and docs
  updated with how to be author on zenodo
  ([`ff73bc0`](https://github.com/OO-LD/oold-python/commit/ff73bc063afcabd27aa3b564ddcce08d96640b5d))

- Ignore local files
  ([`bf1a9e0`](https://github.com/OO-LD/oold-python/commit/bf1a9e093d58a13436316eb6d09d3c73599a82e1))

- **release**: Seed version fields and changelog for psr
  ([`df5f4a8`](https://github.com/OO-LD/oold-python/commit/df5f4a8ae97ede104826df6f32fe9d8d1ee2a517))

### Continuous Integration

- Add conventional-commit commit-msg hook
  ([`d263194`](https://github.com/OO-LD/oold-python/commit/d263194ab0c428fdd27e88e680f75c61fe380472))

- Add semantic-release version preview on pull requests
  ([`75a2998`](https://github.com/OO-LD/oold-python/commit/75a29981387b91e3f8934fc515e6865367efcb22))

- Fix version-preview to show bump and changelog, v-prefixed and reworded
  ([`4db8800`](https://github.com/OO-LD/oold-python/commit/4db8800177b077610543dea1c7d3120ac8b31dfa))

- Make version-preview evaluate on main so PR bump shows correctly
  ([`92d4101`](https://github.com/OO-LD/oold-python/commit/92d410104d539236b4fc34bb7a5b02925ab98a81))

- **release**: Automate release on merge to main via psr
  ([`5ddafe7`](https://github.com/OO-LD/oold-python/commit/5ddafe7d850717acb4e353f406e4b592ab27add4))

- **release**: Configure python-semantic-release (psr) with static version
  ([`b81a511`](https://github.com/OO-LD/oold-python/commit/b81a511801ff25046b688f9a776ba1733aecdb04))

- **release**: Push release commit via github app token to satisfy branch ruleset
  ([`2e64068`](https://github.com/OO-LD/oold-python/commit/2e640683a819a0a4261ff2e635e15f09ae081284))

### Documentation

- Add landing hero on Home, move old content to new About page
  ([`32d22b5`](https://github.com/OO-LD/oold-python/commit/32d22b5041105f870546bae5021fb3eb5ad29b60))

- Add OO-LD logo, fix tab/icon rendering, uv-first install, tidy README
  ([`9404a1d`](https://github.com/OO-LD/oold-python/commit/9404a1d092e6eb8f354c12fd80e8891c3fe0b30e))

- Add tabs nav + logo + landing hero, fix page title, tidy README
  ([`e16d80c`](https://github.com/OO-LD/oold-python/commit/e16d80c73721b2fd972aa8bd75c919840a00106b))

- Drop redundant Development page (merged into Contributing)
  ([`6c929c2`](https://github.com/OO-LD/oold-python/commit/6c929c2fbf922e0b2d351b22197b7c549b7984eb))

- Fix + enlarge mermaid diagrams, hide footer on landing page
  ([`c87a92d`](https://github.com/OO-LD/oold-python/commit/c87a92ddd6fc93cc87e8abff15131ab0e930b7b7))

- Fix home hero right-side gap and top alignment
  ([`c6a9d0b`](https://github.com/OO-LD/oold-python/commit/c6a9d0bfcf1a9253281361f805032040b74b927e))

_{Preview via python-semantic-release and conventional commits.}

[github-actions]

📊 Benchmark Results

Click to see benchmark comparison

📊 Benchmark Comparison (threshold: 1.3x)
============================================================

➖ Unchanged (within threshold):
  ➖ test_simple_dict_document_store: 0.0017s → 0.0017s (-0.8%)
  ➖ test_sqlite_document_store: 0.0019s → 0.0019s (-0.6%)
  ➖ test_local_sparql_store: 0.0395s → 0.0398s (+0.7%)
  ➖ test_oneof_subschema: 0.0609s → 0.0641s (+5.3%)
  ➖ test_enum_docstrings: 0.0514s → 0.0527s (+2.4%)
  ➖ test_subclass_inheritance: 0.0552s → 0.0563s (+2.0%)
  ➖ test_class_hierarchy: 0.0520s → 0.0576s (+10.8%)
  ➖ test_core[v1]: 0.0392s → 0.0405s (+3.3%)
  ➖ test_core[v2]: 0.0450s → 0.0466s (+3.7%)
  ➖ test_schema_generation[v1]: 0.0017s → 0.0017s (+1.2%)
  ➖ test_schema_generation[v2]: 0.0029s → 0.0029s (-1.5%)
  ➖ test_simple_json: 0.0007s → 0.0007s (+1.5%)
  ➖ test_complex_graph: 0.0017s → 0.0017s (-0.2%)

============================================================
Summary: 0 regressions, 0 improvements, 13 unchanged
============================================================

✅ No significant performance regressions

Threshold: 1.3x (30% slower triggers a regression warning)

Note: Benchmarks are informational only and won't fail the build.

_{💡 Tip: Download the benchmark-results artifact for detailed JSON data}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📊 Benchmark Results

Click to see benchmark comparison

📊 Benchmark Comparison (threshold: 1.3x)
============================================================

➖ Unchanged (within threshold):
  ➖ test_simple_dict_document_store: 0.0017s → 0.0017s (-0.0%)
  ➖ test_sqlite_document_store: 0.0019s → 0.0019s (+3.6%)
  ➖ test_local_sparql_store: 0.0398s → 0.0399s (+0.4%)
  ➖ test_oneof_subschema: 0.0606s → 0.0615s (+1.4%)
  ➖ test_enum_docstrings: 0.0509s → 0.0509s (-0.1%)
  ➖ test_subclass_inheritance: 0.0542s → 0.0547s (+1.1%)
  ➖ test_class_hierarchy: 0.0518s → 0.0519s (+0.3%)
  ➖ test_core[v1]: 0.0389s → 0.0394s (+1.3%)
  ➖ test_core[v2]: 0.0449s → 0.0451s (+0.4%)
  ➖ test_schema_generation[v1]: 0.0017s → 0.0017s (+1.2%)
  ➖ test_schema_generation[v2]: 0.0028s → 0.0028s (+0.3%)
  ➖ test_simple_json: 0.0007s → 0.0007s (-0.1%)
  ➖ test_complex_graph: 0.0017s → 0.0017s (-0.6%)

============================================================
Summary: 0 regressions, 0 improvements, 13 unchanged
============================================================

✅ No significant performance regressions

Threshold: 1.3x (30% slower triggers a regression warning)

Note: Benchmarks are informational only and won't fail the build.

_{💡 Tip: Download the benchmark-results artifact for detailed JSON data}

[github-actions]

📊 Benchmark Results

Click to see benchmark comparison

📊 Benchmark Comparison (threshold: 1.3x)
============================================================

➖ Unchanged (within threshold):
  ➖ test_simple_dict_document_store: 0.0016s → 0.0016s (-0.8%)
  ➖ test_sqlite_document_store: 0.0017s → 0.0017s (-0.0%)
  ➖ test_local_sparql_store: 0.0370s → 0.0371s (+0.1%)
  ➖ test_oneof_subschema: 0.0553s → 0.0557s (+0.6%)
  ➖ test_enum_docstrings: 0.0468s → 0.0471s (+0.6%)
  ➖ test_subclass_inheritance: 0.0501s → 0.0505s (+0.7%)
  ➖ test_class_hierarchy: 0.0476s → 0.0486s (+2.1%)
  ➖ test_core[v1]: 0.0357s → 0.0363s (+1.6%)
  ➖ test_core[v2]: 0.0414s → 0.0416s (+0.4%)
  ➖ test_schema_generation[v1]: 0.0015s → 0.0015s (-0.5%)
  ➖ test_schema_generation[v2]: 0.0026s → 0.0026s (+0.1%)
  ➖ test_simple_json: 0.0006s → 0.0006s (+1.3%)
  ➖ test_complex_graph: 0.0015s → 0.0015s (+0.0%)

============================================================
Summary: 0 regressions, 0 improvements, 13 unchanged
============================================================

✅ No significant performance regressions

Threshold: 1.3x (30% slower triggers a regression warning)

Note: Benchmarks are informational only and won't fail the build.

_{💡 Tip: Download the benchmark-results artifact for detailed JSON data}