feat(sdk): automate reviewed npm release tags

[samuv]

Summary

Automate TypeScript SDK release preparation and tagging with the existing release GitHub App. A maintainer dispatches a version-bump workflow, reviews and merges the generated two-file PR, then approves the npm staging environment and the staged npm candidate.

Development stage

• Implementation — human-directed follow-up to ADR 0328

Contract linkage

• Work classification: Architectural
• Classification rationale: Changes the SDK release authority and tag-creation workflow.
• Decision record: ADR 0328, Decision 8
• Human waiver of separate plan PR: Yes — requested directly after the initial v0.1.0 tag.

Changes

• Add Create TypeScript SDK Release PR, manually dispatched from main with a patch/minor/major choice.
• Add sdk/typescript/VERSION as an SDK-only release trigger, kept equal to package.json.
• Have the existing release GitHub App create the exact two-file version PR so normal PR CI runs.
• After merge, verify the App-authored PR, exact diff, monotonic version, previous tag, and package identity before the App pushes sdk/typescript/vX.Y.Z.
• Keep the npm workflow stage-only; the App-authored tag lets a maintainer approve npm-publish even when prevent-self-review is enabled.
• Read the callback MCP server version from the packaged package.json, preventing stale hard-coded runtime versions after a bump.

Security boundaries

• Both automation jobs run only from main and use the existing release Environment.
• The App token is minted only after read-only validation and is scoped to the required operation.
• GITHUB_TOKEN never pushes the release branch or tag; App-authored events cascade into PR CI and the npm tag workflow.
• Ordinary package.json dependency edits cannot trigger tagging; only sdk/typescript/VERSION does.
• The tag workflow refuses non-bot PRs, extra files, missing prior tags, non-monotonic versions, and tag movement.

Test plan

• task lint:actions
• Focused ADR 0328 / Scenario 11 Go workflow-contract tests
• task sdk:lint sdk:typecheck
• SDK package and callback-host Vitest tests
• TypeScript 5.7 and 6 declaration-consumer tests
• SDK API report check
• task docs

This PR does not create or publish a new SDK version. After merge, the next release begins by dispatching Create TypeScript SDK Release PR from main.