After a 409 the server asks to retry with app_id, but a non-empty
app_id switched the plugin to the per-app endpoint, which rejects agk_
keys with 403. An agk_ key now always goes to POST /api/releases and
passes app_id in the body when set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>