fix: authenticate iOS XCFramework download in MAUI workflows

[MD4]

Problem

The CI workflow's .NET MAUI SDK job has been failing on every MAUI-containing commit at the Download Screeb iOS XCFramework step:

KeyError: 'assets'

The step parsed api.github.com/repos/ScreebApp/sdk-ios-public/releases/latest via an unauthenticated curl. The repo is public and the latest release (3.2.4) has the Screeb.zip asset — but unauthenticated API requests are capped at 60/hour per IP, and GitHub-hosted macOS runners share NAT IPs. The call gets a 403 {"message": "API rate limit exceeded ..."} body, which has no assets key → KeyError.

Fix

Use gh release download authenticated with the built-in GITHUB_TOKEN (raises the limit to 1,000+/hour) and drop the fragile inline Python:

- name: Download Screeb iOS XCFramework
  env:
    GH_TOKEN: ${{ github.token }}
  run: |
    mkdir -p packages/sdk-maui/native/ios
    gh release download --repo ScreebApp/sdk-ios-public --pattern 'Screeb.zip' --output /tmp/Screeb.zip --clobber
    unzip -q /tmp/Screeb.zip -d /tmp/screeb_ios
    cp -r /tmp/screeb_ios/Screeb.xcframework packages/sdk-maui/native/ios/

Applied to both ci.yml (maui job) and publish-maui.yml (same broken step). No new secret needed; default contents: read is sufficient. Verified gh release download fetches the asset locally.

Note

This unblocks the download step. The MAUI job's later steps (restore / build android+ios / tests) have not previously run to completion, so if one fails after this, it's a distinct follow-up.