Document winget classic PAT requirement in release config

[Nashon-Steffen]

Summary

The v0.50.0 release (run 35362582357) failed in GoReleaser's winget publisher:

winget: could not get default branch: GET https://api.github.com/repos/stacklok/winget-pkgs: 401 Bad credentials

401 Bad credentials means the WINGET_GITHUB_TOKEN classic PAT expired or was revoked. Unblocking the release is an operational task (rotate the secret, re-run the job) — but the reason this token exists as a static PAT was undocumented, which is a trap: the release config carefully explains the homebrew-tap App token and macOS signing, so the natural next step is to "modernize" winget onto a GitHub App token too. That migration would re-break releases, just with a different error.

Winget is not like the homebrew tap. GoReleaser commits the homebrew formula directly to stacklok/homebrew-tap (a repo the App is installed on), but the winget pipe pushes a branch to the stacklok/winget-pkgs fork and then opens a cross-account PR into microsoft/winget-pkgs. Only a classic PAT with full repo scope can open a fork→upstream PR — GitHub App installation tokens and fine-grained PATs are scoped to a single account and get 403 Resource not accessible by integration creating that PR.

This PR adds comments to .goreleaser.yaml and .github/workflows/releaser.yml capturing that constraint and the "a 401 means rotate-and-rerun" remedy, so the knowledge lives with the code. No behavior change.

Type of change

• Documentation update

Test plan

• Comment-only change to release config; no code paths altered. Verified the edits are additive (18 insertions, 0 deletions) and the surrounding YAML is unchanged.

Does this introduce a user-facing change?

No.

Special notes for reviewers

This does not fix the failed release — that needs an admin to rotate WINGET_GITHUB_TOKEN (ideally a bot account's classic PAT with a tracked expiry) and re-run the failed job. This PR only prevents the footgun of migrating winget to an App token.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.19%. Comparing base (a31832b) to head (61ac551).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6692   +/-   ##
=======================================
  Coverage   79.18%   79.19%           
=======================================
  Files         795      795           
  Lines       80380    80380           
=======================================
+ Hits        63652    63659    +7     
+ Misses      16723    16716    -7     
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.