Use the SDK release bot for changelog updates

[bjarn]

Summary

• create a repository-scoped token for the Lettermint SDK Release Bot
• allow only CHANGELOG.md to change
• commit and push the changelog with the bot identity
• keep the workflow GITHUB_TOKEN read-only
• pin the security-sensitive actions to commit SHAs

Validation

• git diff --check
• workflow structure compared with the Rust SDK implementation

Changelog status

Backfilled all missing releases through v2.6.0, including v1.0.0.