fix: Update version bump workflow to use application token

Author: mala-emnify

.github/workflows/bump-version.yml

@@ -12,9 +12,10 @@ jobs:
     name: Bump and Release
     permissions:
       contents: write
-    # Prevent circular workflow run. Keyed on the commit message rather than the
-    # pusher, which is no longer a fixed user name. (Belt and braces: pushes made
-    # with GITHUB_TOKEN do not trigger workflows.)
+    # Prevent circular workflow run. Keyed on the commit message, not the pusher:
+    # the bump is pushed by the emnify-github-actions App (pusher name
+    # emnify-github-actions[bot], which does not match the old 'emnify-gha'
+    # check), and App pushes DO re-trigger workflows.
     if: "!contains(github.event.head_commit.message, '[Automated] Version Bump')"
     runs-on: ubuntu-latest
 
@@ -24,7 +25,19 @@ jobs:
         with:
           access_token: ${{ github.token }}
 
+      # Installation token for the emnify-github-actions App, which is on the
+      # bypass list for protected main and so can push the version bump. Replaces
+      # the expired EMNIFY_GITHUB_ACTIONS_TOKEN PAT.
+      - name: Retrieve application token
+        id: get_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.EMNIFY_GITHUB_ACTIONS_APP_ID }}
+          private-key: ${{ secrets.EMNIFY_GITHUB_ACTIONS_APP_PEM }}
+
       - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.get_token.outputs.token }}
 
       - name: Bump version and push tag
         id: tag_version