Release workflow: skip the duplicate tag-push run and pin the App token action

[anandhu-eng]

Follow-up to #320, targeting its branch.

Problem

The manual release now pushes its tag with the mlc-automations App token. Unlike GITHUB_TOKEN, App-token pushes start workflows, so the v* tag push starts a second run of build_wheels.yml. That run waits for the manual run to finish (concurrency group), then rebuilds and re-publishes the same version:

• PyPI: the upload is silently skipped (skip-existing: true)
• GitHub Release: the assets are replaced (--clobber) with the second build, which may not match what is on PyPI byte for byte

Changes

• Skip tag-push runs started by the bot, the same approach format.yml uses:

  if: >-
    github.repository_owner == 'mlcommons'
    && !(github.event_name == 'push' && github.actor == 'mlc-automations[bot]')

  Tags pushed by people still publish. Every workflow_dispatch run still works, including retries from a tag. The skipped run shows as "Skipped" in the Actions tab.
• Pin actions/create-github-app-token to bcd2ba49… (v3.2.0), like every other action in the workflow. It was on the floating @v1 tag. app-id still works on v3 (it's deprecated in favour of client-id), so the existing secrets are unchanged.
• Tests: added a test for the job condition, and one that checks every action is pinned to a 40-character commit SHA. The test that asserted @v1 has been relaxed.

pytest tests/test_build_wheels_workflow.py tests/test_release_version.py: 18 passed.

Still needed outside this PR

• mlc-automations must be added as a bypass actor on the main ruleset. The API currently shows none, so git push origin HEAD:main in "Prepare release from main" would be rejected.
• Automate workflow-dispatched PyPI and GitHub releases #320's description still says main is fast-forwarded after publishing. It now pushes the VERSION bump to main before tagging.

🤖 Generated with Claude Code

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[github-actions]

🤖 AI PR Review Summary

This PR updates the GitHub Actions workflow to prevent duplicate release builds triggered by the GitHub App token push by adding a condition to the job's if clause. It also pins the 'actions/create-github-app-token' action to a specific commit SHA instead of a version tag. Corresponding tests are added or updated to verify these changes. The main risk is ensuring the condition correctly prevents duplicate runs without blocking legitimate builds. The pinning to commit SHAs improves reproducibility but requires maintenance to update SHAs when actions are updated.