[vitormattos]

Summary

Align LibreSign main release workflows with published release-tool v0.12.0 (commit 51355769089a6796c23d6c966108afbdaf858c32) and the simplified PHP 8.5 publisher from LibreCodeCoop/.github#110.

• Synchronize prepare-release, nightly-release and App Store publication from the authoritative template using the existing patches, preserving project-specific overrides.
• Pin the shared App Store publisher to immutable catalog Action commit 8828d1047c31ac1c6bf1998436b2a73e7e5c6288 — no runtime catalog/latest-release comparison.
• Update independently maintained release-metadata and resume-release workflows to avoid mixed release-tool revisions.
• Update workflow-lock provenance to the revised catalog template; the template source SHA-256 was recomputed.
• The redundant standalone Bats pin-check script was removed; version alignment is reviewed in the workflow diff and upstream catalog tests.

Validation

• Official workflow sync applied project-specific patches successfully (prior sync: blocked=false, patch_failed=false).
• Published v0.12.0 PHAR validated the LibreSign main release configuration with PHP 8.5.
• GitHub CI is running for this revised PR head; check completion before merge.
• Commits Git Signing MCP verified and DCO-compliant.

Dependencies

Reviewable now; do not merge before catalog LibreCodeCoop/.github#110 is merged and reviewed. Independent stable lines are handled in #9361, #9362, and #9363.