Brief description of what this PR does and why.

• authplane-sdk (core)
• authplane-mcp
• authplane-spring
• None (infra / docs / CI only)

How was this tested? Include relevant test names or manual verification steps.

• mvn -B verify passes for affected modules
• Checkstyle + tests green
• Coverage unchanged or improved
• Tests added for new functionality
• Documentation updated (if applicable)
• CHANGELOG.md entry added under [Unreleased] (if user-facing)
• New workflow actions are SHA-pinned (pinact run after changes)
• No token values, secrets, or key material in logs or test fixtures