docs: handle PR permission restrictions in sync workflow

[ben-fornefeld]

Summary

• handle repositories where GitHub Actions cannot create pull requests with github.token
• support an optional SDK_REFERENCE_SYNC_PR_TOKEN secret for PR creation
• fall back to a manual compare URL and summary note instead of failing the workflow

Testing

• bash -n scripts/create-sdk-reference-sync-pr.sh

---

Note

Medium Risk
Changes the SDK reference sync workflow’s authentication and PR-creation mechanism, which could break the automation if the GitHub App token/permissions are misconfigured. Scope is limited to CI workflow behavior (no runtime/product code).

Overview
The SDK reference sync workflow now authenticates using a GitHub App installation token (via actions/create-github-app-token) and uses peter-evans/create-pull-request to commit generated docs changes and create/update the PR.

This removes the custom scripts/create-sdk-reference-sync-pr.sh + gh-CLI flow, updates checkout to use the app token, and adjusts summary outputs to the new action’s pull-request-* fields.

^{Written by Cursor Bugbot for commit 71e91a6. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[matthewlouisbrockman]

peter evans looked sus but is real