ci(release): dispatch ic-mops bump to caffeinelabs/app

[Kamirus]

After each CLI release is published to npm and GitHub, notify private caffeinelabs/app so it can open the usual two-pin ic-mops bump PR.

Dispatch runs immediately after gh release create, before canister deploy / artifacts. Notify steps use continue-on-error so a dispatch hiccup cannot skip on-chain deploy.

Merge app first (#6933), then this, so the listener exists before the next cli-v* release.

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Category	Assessment	Details
Summary	✅	After a successful gh release create, the CLI release workflow best-effort dispatches mops-cli-release to caffeinelabs/app so it can open the usual ic-mops pin bump PR.
Code Quality	✅	Reuses the existing GitHub App credential pattern already used later in the same workflow; no speculative helpers.
Consistency	✅	Matches the file’s existing create-github-app-token usage, SHA-pinned actions, and release-step layout.
Security	✅	No trigger/permission broadening; reuses existing app secrets; new token is scoped to repositories: app; new action is SHA-pinned; payload values come from already-validated version/tag outputs.
Tests	✅	Workflow-only change; no new test surface expected.
Maintainability	✅	Clear comments and continue-on-error so notify failures cannot skip on-chain deploy/artifacts.

Verdict

Decision: APPROVE
Risk: Very Low
Reason: Additive, best-effort CI notify after npm/GitHub release using already-present app credentials and SHA-pinned actions, with no publish/deploy behavior change and failures explicitly non-blocking.

---

Generated for commit 243065c