[vmvarela]

Linked issue

Refs #264

What

• Replace the per-channel package secrets (HOMEBREW_TAP_TOKEN, APT_PACKAGES_TOKEN, RPM_PACKAGES_TOKEN, APK_PACKAGES_TOKEN, NIX_PACKAGES_TOKEN, SCOOP_BUCKET_TOKEN, WINGET_GITHUB_TOKEN) with secrets.PACKAGE_DISTRIBUTION_TOKEN in .github/workflows/release.yml.
• Update comments and environment variable names that carried the old secret names.

Why

One token is one place to rotate and one secret to provision for every package channel.

How tested

• git diff --check, YAML parsing and actionlint -shellcheck= on the changed workflow.
• Grep of the old secret names across .github, docs and README: no matches.
• Not tested against real destinations: the first release after merge exercises the token.

Remaining work

• Verify that PACKAGE_DISTRIBUTION_TOKEN has contents:write on each destination and public_repo for WinGet before the release.
• Delete the old per-channel secrets after the merge is verified.