ci: author, review, and automerge regen prs via github apps

[mekilis]

Regen PRs are now authored with a convoy-sdk-bot GitHub App token (replacing the personal PAT), so CI triggers as before without depending on a user account. A separate reviewer app approves only diffs whose changed files all match the repo's generated paths; anything else is left unapproved with a comment for human review. Auto-merge is queued after approval, so unresolved finding conversations and the required checks (tests, Cursor Bugbot, Cursor Security Agent) still block the merge.

---

Note

Medium Risk
Changes CI automation that can approve and queue merges of generated SDK output; safeguards limit auto-approval to allowlisted paths and bot-authored PRs, but misconfiguration of app secrets or the path list could widen what ships without human review.

Overview
Automates regen PR authorship and review using GitHub Apps instead of a personal access token, so opened PRs still run pull_request CI and merges can trigger downstream publish workflows.

The workflow mints a convoy-sdk-bot app token for checkout, push, and PR creation (replacing SDK_BOT_PAT / GITHUB_TOKEN fallbacks) and commits as convoy-sdk-bot[bot]. When there is a diff, a second SDK reviewer app approves only PRs authored by that bot whose changed files stay within the generated allowlist (api, client, models under com/getconvoy, aligned with scripts/generate.sh); other paths or authors get a comment and no approval. After a clean approval, squash auto-merge is enabled via the bot token so required checks still gate the merge.

^{Reviewed by Cursor Bugbot for commit 9906149. Bugbot is set up for automated code reviews on this repo. Configure here.}