[Troublor]

Summary

Release actions currently persist installation tokens in Git authentication headers. Add a command-scoped GitHub HTTPS authentication component using GIT_ASKPASS, disable credential storage for its commands, and use it for release fetches and pushes without changing Git auth configuration or remote URLs.

Keep existing release-action inputs compatible and add an optional read-only dependency_token for candidate dependency updates. Document the new action and exercise clone, recursive submodules, push, Cargo fetch followed by an offline build, authentication failures, stale checkout credentials, step outputs, and credential non-persistence against a local HTTPS Git server.

Test plan

• Eight local Git/Cargo authentication integration tests passed; no real GitHub credential is used.
• Twenty release-tool tests and the existing release-candidate workflow rehearsal passed.
• actionlint, shellcheck, generated documentation check, Bash syntax checks, and git diff --check passed.
• Live installation permissions and release operations still require CI validation. No release, App permission, or credential configuration has been changed.