ci: use GitHub STS for changelog generation instead of app credentials

[sds]

Summary

Replaces the release-bot GitHub App token minting in changelog-generate.yml with a github-sts token exchange:

• Adds .github/sts/release.sts.yaml, a trust policy that lets jobs running in the release environment mint a short-lived token (contents + pull-requests write) scoped to this repository.
• The generate job now grants id-token: write and fetches its token via STS instead of stored App credentials; the existing same-repo gating is unchanged.

Notes

The App credentials were never configured in this repository, so the changelog push step has been failing silently when reached. This change makes it functional.

Verified: actionlint and zizmor pass with no new findings, and the policy subject matches this repository's ID-annotated OIDC sub customization.