llm: Push SDK-update evaluation fixes with a freshly minted app token

[SaintPatrck]

🎟️ Tracking

Failed SDK-update evaluation run: https://github.com/bitwarden/android/actions/runs/38936477036

📔 Objective

The GitHub App installation token we mint at the start of the SDK-update evaluation job expires after an hour, so whenever the Claude step runs long the push fails with "Invalid username or token" and Claude's fix commit is discarded. The push now authenticates with a token minted after Claude finishes, so it succeeds however long the evaluation takes.

🤖 AI-assisted review

Standard local review (code-review-local) approved with no findings.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR changes .github/workflows/sdlc-sdk-update-evaluate.yml so the push step authenticates with a GitHub App installation token minted after the Claude step finishes. Before, the push reused the checkout token, which can expire during a long evaluation. The new step reuses the Key Vault outputs already fetched in the job, requests only contents: write, and the token never reaches Claude's environment. It also arrives in the script through env as a masked step output instead of being interpolated. The -c http.https://github.com/.extraheader= override is read after the checkout-persisted config, so the empty value resets the multi-valued header list and only the fresh URL credential is sent.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.80%. Comparing base (1470154) to head (1ac6f9f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7491   +/-   ##
=======================================
  Coverage   86.80%   86.80%           
=======================================
  Files         895      895           
  Lines       65684    65684           
  Branches     9385     9385           
=======================================
  Hits        57015    57015           
  Misses       5189     5189           
  Partials     3480     3480           

Flag	Coverage Δ
app-data	18.65% <ø> (ø)
app-ui-auth-tools	18.68% <ø> (ø)
app-ui-platform	16.49% <ø> (ø)
app-ui-vault	26.89% <ø> (ø)
authenticator	6.03% <ø> (ø)
lib-core-network-bridge	4.11% <ø> (ø)
lib-data-ui	1.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.