chore: fix version bump workflow

[brendan-ch]

Summary

The Bump version workflow's most recent run failed in ~11s at the push step:

fatal: no branch named 'chore/versioning-workflow'

The step ran git branch -m "chore/versioning-workflow" "$BRANCH_NAME" — a leftover from when the workflow was authored on that branch. It tried to rename a branch that doesn't exist (the workflow checks out github.ref, which is main when dispatched from main), and as a side effect committed directly onto main. A second latent bug followed: gh pr create ran without a token, so it would have failed auth even if the push had succeeded.

Changes

• Branch creation — replaced the bogus git branch -m with git checkout -B chore/bump-version-<ver>, so a proper branch is created off whatever ref was dispatched. -B keeps re-runs idempotent.
• Git identity — set github-actions[bot] explicitly (the prior run only worked by falling back to the runner default).
• PR auth — added GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} to the gh pr create step.
• Runner — moved off macos-26 + the xcode-select step to ubuntu-latest; this job is a pure sed edit of project.pbxproj, so no Xcode/build is needed. Switched BSD sed -i '' to GNU sed -i and dropped the unused .bak copy.

Test plan

• Diagnosed from the failed run logs (gh run view --log-failed); confirmed the failed run never pushed, so remote main is untouched.
• YAML validated.
• Dispatch the Bump version workflow once after merge to confirm it creates the branch + draft PR end-to-end (can only be verified by an actual workflow_dispatch run).

🤖 Generated with Claude Code