fix(ci): fix workflow checkout ordering, refactor drift detection

[benminer]

Summary

Two sets of fixes for CI workflow reliability:

Workflow checkout ordering (release.yml, regenerate-schemas.yml)

The actions/checkout step was dependent on create-github-app-token, meaning if the token step failed, checkout was skipped and the local .github/actions/slack-post composite action was unavailable for failure notifications. This created a silent failure mode where we'd get no Slack alert on token errors.

• Move checkout before app token generation in both release.yml and regenerate-schemas.yml
• Configure the git remote URL with the app token after checkout via git remote set-url, preserving the app identity for pushes
• Remove npm install -g npm@latest from release.yml — Node 22 ships with npm 10.x which already supports OIDC provenance publishing, and the self-update was failing with a promise-retry MODULE_NOT_FOUND error

Drift detection refactor (drift-detection.yml)

The drift detection workflow was sending empty Slack alerts when the script exited non-zero but produced no valid drift data (e.g. script error misinterpreted as drift). The bash/jq parsing logic had grown complex across two steps.

• Replace the bash "Run drift detection" and "Parse drift report" steps with a single actions/github-script@v7 step
• Use the existing report.hasDrift boolean from the script output instead of manual totalDrift string comparisons
• Validate the drift report JSON before alerting — malformed or empty output no longer triggers a misleading "SDK API Drift Detected" message
• Add a dedicated "Drift Detection Script Error" Slack alert for non-zero exits with invalid output
• Add a 2-minute timeout on the drift detection subprocess

Test plan

• Trigger release workflow and verify checkout, token generation, and changesets action succeed
• Trigger regenerate-schemas workflow manually and verify git push uses the app token identity
• Trigger drift-detection workflow manually and verify no false-positive Slack alert is sent
• Simulate a token failure and verify the Slack failure notification is sent (checkout now always succeeds)

[nastassiafulconis]

makes sense to me!