ci: fix lint failures blocking main (#2496)
Main is red on the Lint Code Base job for two deterministic reasons.
## clang-format
`frankenphp.c:141` — the empty `while` body must sit on its own line.
## zizmor `github-app`
zizmor 1.26 added the `github-app` audit, which flags
`actions/create-github-app-token` invocations that inherit blanket
installation permissions. Scoped the release app token
(`dunglas-release`) to what it actually uses:
- `contents: write` — commits, tags, refs, GitHub releases
- `actions: write` — `gh workflow run` dispatch of downstream builds
(static/docker/windows)
Both verified locally: `zizmor` reports no findings, `clang-format
--dry-run --Werror` is clean.
