ci(release): use shared Python publishing actions (#706)

Replace the custom production PyPI workflow with the commit-pinned
[`sdk-actions`](https://github.com/braintrustdata/sdk-actions) turnkey
flow.

```text
Before: merge release PR -> automatic publish
After:  commit version -> dispatch full SHA -> approve environment -> publish
```

Stable releases now use the merge commit from the version-bump PR, and
the workflow rejects stable
release SHAs outside `main`. Prereleases require the prerelease version
to be committed on the target
branch; off-`main` prerelease branches produce a warning instead of
failing. Both use the `publish` environment, while dry runs use
`publish-dry-run`.

Keep the Python-specific `make install-dev verify-build` checks,
release-channel templating, and
existing `py-sdk-v{version}` tag format. Production publishes also
generate and attest a CycloneDX
SBOM through OIDC trusted publishing.

TestPyPI prereleases, canary publishing, and the canary scheduler are
intentionally unchanged.

Required repository configuration:

- GitHub environments `publish` and `publish-dry-run`
- PyPI trusted publisher scoped to workflow `publish-py-sdk.yaml` and
environment `publish`
- `SLACK_SDK_RELEASE_CHANNEL` visible to this repository

Validated with `actionlint`, the sdk-actions workflow validator and
baseline comparison,
`scripts/ensure-pinned-actions.sh`, and pre-commit.

Author: AbhiPrasad

.github/scripts/generate-release-notes.sh

@@ -1,5 +1,5 @@
 # Starts the stable Python SDK release process by opening a PR that bumps the
-# package version. Merge the PR to trigger the approval-gated publish workflow.
+# package version. After merging, manually publish the merge commit's SHA.
 name: Prepare Stable Python SDK Release
 
 on:
@@ -61,6 +61,6 @@ jobs:
           commit-message: "chore: release Python SDK v${{ inputs.version }}"
           title: "chore: release Python SDK v${{ inputs.version }}"
           body: |
-            Automated stable Python SDK release PR for `${{ inputs.version }}`. Merging will trigger approval-gated publishing and create the `py-sdk-v${{ inputs.version }}` release tag.
+            Automated stable Python SDK release PR for `${{ inputs.version }}`. After merging, run `Publish Python SDK` with the merge commit SHA to publish and create the `py-sdk-v${{ inputs.version }}` release tag.
 
             ${{ steps.changeset.outputs.body }}