Use the SDK release bot for changelog updates

[bjarn]

Summary

• create a repository-scoped token for the Lettermint SDK Release Bot
• commit and push only CHANGELOG.md with the bot identity
• keep package.json and package-lock.json changes in a reviewable pull request
• reject any other changed path
• pin the security-sensitive actions to commit SHAs

Validation

• git diff --check
• workflow structure compared with the Rust SDK implementation

Changelog status

Added the missing v2.7.0 release notes.