Migrate CI generation to zio-sbt-ci

[khajavi]

Draft: uses a zio-sbt snapshot. project/plugins.sbt and zio-aws-codegen/build.sbt pin 0.8.5+3-9742dfda-SNAPSHOT, the merge commit of zio/zio-sbt#823, from the Sonatype snapshot repository. Replace both with the release version once zio-sbt releases it.

What

• Remove the hand-rolled GithubActionsGenerator and its circe workflow model, and the generateCiYaml task.
• Build the jobs (tag, build-core, integration-test, build-clients-N, release) in ZioAwsCi and feed them to zio-sbt-ci through ciBuildJobs / ciReleaseJobs.
• Switch off what the plugin would otherwise add around them: stock lint/test/update-readme/post-release jobs, the aggregate ci job, the workflow permissions block, the concurrency group. The last two settings need zio-sbt#823.
• Run Scala Steward through the plugin's workflow as the zio-scala-steward GitHub App, and set the auto-approve/auto-merge bots to dependabot[bot], renovate[bot] and zio-scala-steward[bot]. These PRs used to come from a personal token.
• Regenerated ci.yml, plus new auto-approve.yml, auto-merge.yml and a generated scala-steward.yml (replaces the hand-written one).

Verified

Parsed as YAML, the generated ci.yml equals the previous one: same 10 jobs in the same order, same steps, conditions, matrices, services and env. Normalised away: continue-on-error: false, fail-fast: true and env: {}, which the plugin spells out and are no-ops. Textually it differs: header comment and no line folding (784 lines vs 1085).

This was checked in a scratch sbt build using the snapshot plugin, ZioAwsCi and the module list from the committed ci.yml. The repo's own build was not run: sbt-git fails on the git worktree I worked in, and the loader clones the AWS SDK on every load. So the wiring that fills ZioAwsCodegenPlugin.moduleNames from the loader only compiled and is untested. sbt ciGenerateGithubWorkflow on a normal clone should regenerate the same files.

Before merging

• zio-sbt release containing Update aws-core, http-client-spi, ... to 2.17.183 #823; replace the two snapshot pins
• SCALA_STEWARD_GITHUB_APP_ID, SCALA_STEWARD_GITHUB_APP_INSTALLATION_ID, SCALA_STEWARD_GITHUB_APP_PRIVATE_KEY available (repo or org), and the app installed on this repo. Otherwise the Steward job fails.
• APP_ID / APP_PRIVATE_KEY for auto-merge.yml, or it falls back to GITHUB_TOKEN, which cannot merge PRs touching .github/workflows/**
• The old Steward workflow ran sbt/setup-sbt first and the generated one does not. Watch the first scheduled run.
• sbt ciGenerateGithubWorkflow on a normal clone leaves no diff