chore(ci): remove sdk-lockstep — SDK pin bumps and releases become manual

[rahlk]

.github/workflows/sdk-lockstep.yml fires on every release here and writes
directly into codellm-devkit/python-sdk: it sets
[tool.backend-versions].codeanalyzer-java, patch-bumps the SDK version,
commits to main, and pushes a v<sdk-version> tag.

We are dropping all cross-repo automation between the analyzers and the SDK.
The Python-side equivalent is removed in codellm-devkit/codeanalyzer-python#122.
TypeScript never had one.

Consequence — read before merging

This workflow is the only thing that pushes v*.*.* tags to python-sdk,
and that tag push is the sole trigger on the SDK's own release.yml
(on: push: tags: v*.*.*). Removing it means SDK releases no longer happen
automatically on a codeanalyzer-java release. Cutting one becomes a manual
bump, commit, tag, push.

This is intended, not an oversight.

Knowledge worth keeping

The workflow header documents a non-obvious packaging constraint that should
not be lost with the file:

Deliberately NOT touched: [project.dependencies] "codeanalyzer-java==X".
That pin resolves from real PyPI (which lags), whereas releases are
distributed as GitHub release assets + a Pages index. The SDK build bundles
the jar directly, so [tool.backend-versions] is the field that tracks the
backend, and bumping the hard dependency pin to a not-on-PyPI version would
break uv sync --frozen.

Anyone doing a manual bump needs this: bump [tool.backend-versions], not
[project.dependencies].

Scope

• delete .github/workflows/sdk-lockstep.yml
• secrets.CLDK_AUTH_TOKEN becomes unused by this workflow; check for
  other consumers before revoking it