ci: use the SDK release app for version bumps

[devin-ai-integration]

Summary

The version bump job minted its token from GH_REPO_ACCESS_* — the enterprise keycard-gha-repository-access app, which is installed across keycardlabs as well. Any workflow holding that private key can mint an installation token for every private keycardlabs repo, so a compromised bump job (or a compromised action in it) reached far outside this repo.

-          app-id: ${{ secrets.GH_REPO_ACCESS_APP_ID }}
-          private-key: ${{ secrets.GH_REPO_ACCESS_PRIVATE_KEY }}
+          app-id: ${{ secrets.SDK_RELEASE_APP_ID }}
+          private-key: ${{ secrets.SDK_RELEASE_PRIVATE_KEY }}

SDK_RELEASE_* is a keycardai-owned app installed only on go-sdk, python-sdk and typescript-sdk, with contents + pull-requests write and no Workflows: write, and its credentials live as repo secrets on those three repos rather than an org secret. Behavior is unchanged: it's still an app token, not GITHUB_TOKEN, so the tag push still triggers the publish workflow (GITHUB_TOKEN pushes do not trigger workflows, which would leave the version bumped and nothing published).

Prerequisites

SDK_RELEASE_APP_ID and SDK_RELEASE_PRIVATE_KEY must exist as repo secrets here, and the app must be on the requireReview bypass list (rulesets:requireReviewBypassActors in keycardlabs/infra, stacks/github/Pulumi.keycardai.yaml) so it can merge the bump PR / push to main.

Residual, for the record: any of the three SDK repos' CI can mint a token for the other two — inherent to app installation scoping, and now confined to keycardai.

Part of the GitHub Actions cross-org audit (keycardlabs <-> keycardai): finding F1.

Link to Devin session: https://app.devin.ai/sessions/6197211c97f643b09c1e0ace7b92d29f
Requested by: @kiambogo

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring