fix(release): support default credentials and record 5.0.0 boundary (#1012)

fix(release): support built-in credentials and refresh release boundary

GitHub now creates approval-required PR workflows for GITHUB_TOKEN-authored
opened/synchronize/reopened events. Restore optional custom credentials and
cover prepare/publish without a separate secret. Record the verified 5.0.0
checkpoint, public 133-tool catalog and package update in the installation guide.

Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution)

.github/workflows/release.yml

@@ -32,16 +32,6 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       sha: ${{ steps.release.outputs.sha }}
     steps:
-      - name: Require a CI-capable release token
-        shell: bash
-        env:
-          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-        run: |
-          if [[ -z "${RELEASE_PLEASE_TOKEN}" ]]; then
-            echo "RELEASE_PLEASE_TOKEN is required. Pull requests and catalog commits created with GITHUB_TOKEN do not start workflow runs, so the normalized release head would have no CI result to approve." >&2
-            exit 1
-          fi
-
       - name: Validate release selection
         shell: bash
         env:
@@ -97,9 +87,9 @@ jobs:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          # A dedicated credential lets release-PR updates trigger CI.
-          # GITHUB_TOKEN-authored pull requests do not start workflow runs.
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          # A dedicated credential starts PR CI automatically; the built-in
+          # token creates approval-required PR runs for maintainers to approve.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           target-branch: ${{ inputs.release_branch }}
           skip-github-release: ${{ inputs.phase == 'prepare' }}
           skip-github-pull-request: ${{ inputs.phase == 'publish' }}
@@ -148,7 +138,7 @@ jobs:
         shell: bash
         env:
           # Use the same identity for the follow-up commit so it also triggers CI.
-          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           RELEASE_PR_JSON: ${{ steps.release.outputs.pr }}
         run: |
           release_pr_branch="$(node --input-type=module -e '