fix(ci): Use GitHub App token for draft PR enforcement

The default GITHUB_TOKEN lacks permission for the GraphQL
convertPullRequestToDraft mutation ("Resource not accessible by
integration"). Switch to the SDK Maintainer Bot GitHub App token
which has the required pull-requests write scope.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stephanie-anderson

.github/workflows/enforce-draft-pr.yml

@@ -4,18 +4,23 @@ on:
   pull_request_target:
     types: [opened, reopened]
 
-permissions:
-  pull-requests: write
-
 jobs:
   enforce-draft:
     name: Enforce Draft PR
     runs-on: ubuntu-24.04
     if: github.event.pull_request.draft == false
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.SDK_MAINTAINER_BOT_APP_ID }}
+          private-key: ${{ secrets.SDK_MAINTAINER_BOT_PRIVATE_KEY }}
+
       - name: Convert PR to draft
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
         with:
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const pullRequest = context.payload.pull_request;
             const repo = context.repo;