ci(release): Switch from action-prepare-release to Craft (#504)

* ci(release): Switch from action-prepare-release to Craft

This PR migrates from the deprecated action-prepare-release to the new
Craft GitHub Actions (reusable workflow or composite action).

Changes:
- Migrate .github/workflows/release.yml to Craft reusable workflow

* ci(release): Restore GitHub App token authentication

The previous migration incorrectly removed the GitHub App token
authentication step. This commit restores it by switching to the
composite action pattern which preserves the auth flow.

* fix: Pin actions to SHA and add permissions blocks

* fix: Use correct action version SHAs (restore original versions)

* fix: Use correct action version SHAs (restore original versions)

* fix: Add permissions block to workflows

* fix: Clean up action version comments

* Update Craft SHA to 1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce

* fix: revert extraneous changes to non-release workflow files

* fix: clean up release.yml formatting and version comments

* build(craft): Update Craft action to c6e2f04

* chore: add unlabeled trigger to changelog-preview

Author: BYK

.github/workflows/changelog-preview.yml

@@ -0,0 +1,18 @@
+name: Changelog Preview
+on:
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - edited
+    - labeled
+    - unlabeled
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  changelog-preview:
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2
+    secrets: inherit

.github/workflows/release.yml

@@ -4,12 +4,16 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Version to release
-        required: true
+        description: Version to release (or "auto")
+        required: false
       force:
         description: Force a release even when there are release-blockers (optional)
         required: false
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -27,7 +31,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare release
-        uses: getsentry/action-prepare-release@c8e1c2009ab08259029170132c384f03c1064c0e
+        uses: getsentry/craft@c6e2f04939b6ee67030588afbb5af76b127d8203 # v2
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with: