ci: adopt shared reusable dev-sync workflow

[supertokens-agent-runner]

Problem

Per PLAN-001 (CI/CD standardization), the dev-sync logic — compute next
version from unreleased changie fragments, then create/force-update the
release/vX.Y.Z → X.Y PR — is duplicated near-verbatim across the three
backend SDKs. This unit (A7) replaces supertokens-python's local copy with
a thin caller of the shared reusable workflow
supertokens/actions/.github/workflows/dev-sync.yml@main, so the
orchestration lives in one place.

Fix

.github/workflows/dev-sync.yml is now a thin caller. All python-specific
behavior is reproduced exactly via the reusable workflow's inputs, so the
generated release PR is equivalent to before:

• python_version: "3.13" → runs actions/setup-python@v5 as before.
• prepare: runs the old doc steps (pip install pdoc3==0.11.0 -e ".[fastapi,flask,django,drf]" then make build-docs) after changie batch/merge.
• add_paths: ".changes/ CHANGELOG.md setup.py supertokens_python/constants.py html/" — identical to the old git add line. Cross-checked against .changie.yaml: its replacements: block rewrites exactly setup.py and supertokens_python/constants.py, and both are staged (no stale-version-file trap).
• version_check_hint / post_merge_note reproduce the old PR-body wording verbatim (checklist points at setup.py/constants.py; after-merge note still says "trigger the Release Pipeline … with branch").
• secrets: inherit forwards ALL_REPO_PAT (the reusable's one required secret).

bump override, triggers (push: [dev] + workflow_dispatch), permissions,
and the run-tests/Skip-Changelog labels are all unchanged.

Tests

No automated test — this is a workflow file. dev-sync triggers only on
push-to-dev and workflow_dispatch, so PR CI does not exercise it. I
verified statically:

• The caller YAML parses and resolves to the reusable workflow with the six expected inputs.
• Diff is a pure swap (18 insertions / 150 deletions), no behavior added.
• Pre-commit hooks all pass (trailing-whitespace, EOF, merge-conflict, no-commit-to-branch, check-version, check-branch).

Not verified

• End-to-end dev-sync PR generation. Only observable on the next push to dev after merge — per PLAN-001 this is the required post-merge validation for A6–A8. Recommend confirming the release PR is created/updated correctly on the first dev push.
• The reusable workflow's own logic (owned by unit A5); this PR only wires python to it.

Cross-SDK note

supertokens-node (A6) already adopted this reusable workflow on dev;
supertokens-golang (A8) is the remaining sibling. One intentional wording
divergence from node's caller: node's post_merge_note was changed to say the
Release Pipeline auto-starts, whereas python's existing behavior says to
trigger it manually with the branch — I preserved python's existing wording to
keep this a faithful extraction, not a behavior change. If the pipeline does
auto-start for python too, that note can be aligned in a follow-up. The
reusable has no node_version input (a node-only concern); N/A here since
python passes python_version.

CI note

supertokens-python's PR CI has a test-gate that fails with "No test label
found" unless the PR carries run-tests/skip-tests. Applying that label is a
human triage decision (like Skip-Changelog), so I've left it — the failure is
pre-existing policy, not caused by this change.

Part of PLAN-001.

Fixes #641

[supertokens-agent-runner]

CI triage

All checks pass except test-gate, which is a pre-existing policy gate, not caused by this change.

• test-gate fails with "No test label found" on every PR that lacks a run-tests or skip-tests label. Applying that label is a human triage decision, so I've left it. Downstream test / setup-auth-react / FDI jobs are gated behind it and therefore show skipping.
• The standardization-relevant checks are green: lint / Lint PR Title and lint / Require Changelog Fragment (the shared lint-pr caller adopted in the sibling A3 unit) both pass — the semantic ci: title and the Infrastructure changie fragment satisfy them.
• All Check linting and formatting (3.8–3.13) pass.

Nothing here needs a code change. Note that dev-sync itself is not exercised by PR CI (it triggers only on push-to-dev and workflow_dispatch), so its behavior can only be validated on the first push to dev after merge — see the "Not verified" section of the PR description.