Drop unnecessary secrets: inherit and lock codegen merge to App actor

[ptr727]

Summary

Two additional Copilot findings on PR #71 (develop → main release) that PR #72 was supposed to carry alongside the behaviour → behavior fix. Auto-merge on PR #72 fired before the second commit on its branch landed, so PR #72's squash captured only the spelling fix — these two land here separately.

1. secrets: inherit removed from get-version job in build-pypilibrary-task.yml

The job calls get-version-task.yml which declares no required secrets. secrets: inherit was widening the secret blast radius for no benefit. (Same pattern exists in build-nugetlibrary-task.yml, untouched here per AGENTS.md "Workflow YAML Conventions" — "existing workflows are migrated opportunistically when they're being touched for other reasons". Easy follow-up PR later.)

2. merge-codegen if: gate now requires App-actor too

The current gate checks PR author/branch/base but not the event actor. A maintainer pushing extra commits to the App's codegen branch fires a synchronize event the job would happily auto-merge — folding human changes into a release through the App PR. Restored github.actor == 'ptr727-codegen[bot]' (which the pre-consolidation merge-codegen-app job carried in PR #70-era code) alongside the existing PR author check. Comment expanded to explain why both checks matter.

+ # Both the PR author AND the event actor must be the App: the author
+ # check stops human-opened PRs that happen to target the `codegen`
+ # branch from auto-merging; the actor check stops a maintainer
+ # pushing extra commits to the App's `codegen` branch (a
+ # `synchronize` event the human triggered) from auto-merging
+ # unintended changes through the App PR.
  if: >-
    github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
+   github.actor == 'ptr727-codegen[bot]' &&
    github.event.pull_request.head.ref == 'codegen' &&
    github.event.pull_request.base.ref == 'main' &&
    github.event.pull_request.head.repo.full_name == github.repository

Test plan

• CI passes on this PR.
• After merge to develop, PR Standardize bots on GitHub App token, align merge methods, version PyPI via NBGV #71's two remaining Copilot threads (lines 25 and 93) can be resolved.

[Copilot]

Pull request overview

Reduces GitHub Actions secret exposure and tightens the merge-bot’s auto-merge guardrails for codegen PRs to prevent unintended human-triggered updates from being merged via the App’s PR.

Changes:

• Removed secrets: inherit from the PyPI build workflow’s get-version reusable-workflow call (no required secrets).
• Hardened merge-codegen auto-merge gating by requiring both PR author and triggering actor to be ptr727-codegen[bot], with expanded rationale in comments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/merge-bot-pull-request.yml	Tightens merge-codegen if: condition to require bot actor as well as bot PR author.
.github/workflows/build-pypilibrary-task.yml	Drops unnecessary secrets: inherit on the get-version job to reduce secret blast radius.