Use the SDK release bot for changelog updates

[bjarn]

Summary

• create a repository-scoped token for the Lettermint SDK Release Bot
• allow only CHANGELOG.md to change
• commit and push the changelog with the bot identity
• keep the workflow GITHUB_TOKEN read-only
• pin the security-sensitive actions to commit SHAs

Validation

• git diff --check
• workflow structure compared with the Rust SDK implementation

Changelog status

No backfill was required. The changelog already contains every published release through v2.6.0.