Remove `sdk-lockstep` — SDK pin bumps and releases become manual

[rahlk]

Is your feature request related to a problem? Please describe.

.github/workflows/sdk-lockstep.yml fires on every release here and writes directly into codellm-devkit/python-sdk: it sets [tool.backend-versions].codeanalyzer-java, patch-bumps the SDK version, commits to main, and pushes a v<sdk-version> tag.

We are dropping all cross-repo automation between the analyzers and the SDK. The Python-side equivalent is removed in codellm-devkit/codeanalyzer-python#122. TypeScript never had one.

Describe the solution you'd like

Not stated in the original issue.

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Consequence — read before merging

This workflow is the only thing that pushes v*.*.* tags to python-sdk, and that tag push is the sole trigger on the SDK's own release.yml (on: push: tags: v*.*.*). Removing it means SDK releases no longer happen automatically on a codeanalyzer-java release. Cutting one becomes a manual bump, commit, tag, push.

This is intended, not an oversight.

Knowledge worth keeping

The workflow header documents a non-obvious packaging constraint that should not be lost with the file:

Deliberately NOT touched: [project.dependencies] "codeanalyzer-java==X". That pin resolves from real PyPI (which lags), whereas releases are distributed as GitHub release assets + a Pages index. The SDK build bundles the jar directly, so [tool.backend-versions] is the field that tracks the backend, and bumping the hard dependency pin to a not-on-PyPI version would break uv sync --frozen.

Anyone doing a manual bump needs this: bump [tool.backend-versions], not [project.dependencies].

Scope

• delete .github/workflows/sdk-lockstep.yml
• secrets.CLDK_AUTH_TOKEN becomes unused by this workflow; check for other consumers before revoking it