feat: add reusable auto-merge-release-pr workflow - #83

Summary

• New reusable workflow (workflow_call) that auto-merges the chore(main): release x.y.z PR opened by release-please-action, once the PR's checks pass.
• Uses a token minted from a GitHub App (passed in via secrets.app-id / secrets.app-private-key) instead of the default GITHUB_TOKEN. Actions' loop-prevention means a merge/push done with the default token does not trigger other workflows — so the existing push-triggered release workflow (e.g. tofu-release) would never fire and the tag/GitHub Release would never be created. An App-minted token doesn't have that restriction.
• Gating is data-driven via inputs (release_pr_label, release_pr_author, merge_method) so it works across repos regardless of naming/merge-style differences, rather than hardcoding one repo's conventions.

How it works

• Meant to be called from a caller workflow triggered on pull_request (opened/synchronize/labeled).
• Only runs when the PR author matches release_pr_author (default github-actions[bot]) and it carries the release_pr_label (default autorelease: pending) — both set automatically by release-please-action.
• Waits for all of the PR's checks to go green (gh pr checks --watch --fail-fast), then merges using merge_method (default merge).

Example caller usage

```yaml
name: auto-merge-release-pr

on:
pull_request:
types: [opened, synchronize, labeled]

jobs:
automerge:
uses: nullplatform/actions-nullplatform/.github/workflows/auto-merge-release.yml@main
secrets:
app-id: ${{ secrets.APP_RELEASE_ID }}
app-private-key: ${{ secrets.APP_RELEASE_PRIVATE_KEY }}
```

Test plan

• Merge this PR.
• Wire up services-postgresql-rds (ci: auto-merge release-please PRs services-postgresql-rds#5) to call this reusable workflow.
• Trigger a real release-please PR there and confirm auto-merge + downstream tag/release creation works end-to-end.
• Once validated, extend to other module repos.