feat: automate release process

[NicoleMGomes]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Refactors the release process into a clean two-workflow pipeline: prepare-release.yml owns tag creation, version bump (pyproject.toml + uv.lock), and draft GitHub Release creation; release.yml owns integration tests, build, and PyPI publish triggered by the released event. Adds RC and hotfix workflows, Dependabot auto-merge for patch/minor updates, a sdk-review-gate workflow enforcing that PRs carry an sdk-review: label before merging, and a security-review Claude Code skill. Documentation is updated across RELEASE.md, INTEGRATION_TESTS.md, GUIDELINES.md, DEPENDENCIES.md, and CONTRIBUTING.md.

Related Issue

Closes #<issue_number>

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Trigger Actions → Prepare Release → Run workflow on main with a version input — verify a draft GitHub Release and a version bump PR are created, tag is present, uv.lock is updated.
2. Open a Dependabot patch/minor PR and verify it is auto-approved and merged once checks pass; open a major update PR and verify a comment is left for manual review.
3. Open any PR without an sdk-review: label and verify the SDK review label present check fails; run /review-pr and verify the label is applied and the check passes.
4. Review docs/RELEASE.md for the RC and hotfix process steps and verify they match the workflow inputs.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages
• (New modules only) I have attached e2e evidence showing the module working against a real BTP service
• (Security-sensitive changes only) I have run /security-review and addressed all ❌ findings

Additional Notes

Code Review

• [A3] ⚠️ No issue number linked — add Closes #N once the tracking issue is known.

[jeanscherf]

Awesome work!

[jeanscherf]

LGTM

[LucasAlvesSoares]