fix: chain Speakeasy auto-merge into Generate run

The auto-merge workflow triggered on `pull_request: [labeled, opened]`.
When github-actions[bot] opened the regen PR, GitHub's recursion guard
refused to run a workflow triggered by another workflow's GITHUB_TOKEN,
so the run landed as action_required with zero jobs executed. Regen PRs
piled up unmerged and sdk_publish never fired (PyPI stuck at 0.10.0).

Port the TypeScript SDK's architecture: make auto-merge a workflow_call
reusable workflow chained inside the Generate run (generate ->
resolve-branch -> auto-merge). No separate pull_request-triggered run
exists, so there is nothing for GitHub to gate.

- auto-merge-speakeasy-pr.yaml: workflow_call inputs (run_started_at,
  branch_name) + App-token secrets; resolve PR via branch/timestamp;
  .author.is_bot check; wait_for_checks before direct merge; step
  summaries. Keeps the SHA-pinned create-github-app-token.
- sdk_generation.yaml / sdk_generation_for_spec_change.yaml: add
  concurrency group, resolve-branch + auto-merge jobs.

.github/workflows/sdk_generation.yaml

@@ -21,6 +21,11 @@ permissions:
     types:
       - labeled
       - unlabeled
+
+concurrency:
+  group: speakeasy-generate
+  cancel-in-progress: false
+
 jobs:
   generate:
     uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
@@ -32,3 +37,67 @@ jobs:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}
       pypi_token: ${{ secrets.PYPI_TOKEN }}
       speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
+
+  resolve-branch:
+    needs: generate
+    if: ${{ !cancelled() && needs.generate.result == 'success' }}
+    runs-on: ubuntu-latest
+    outputs:
+      branch_name: ${{ steps.branch.outputs.branch_name }}
+      run_started_at: ${{ steps.branch.outputs.run_started_at }}
+    steps:
+      - name: Extract branch from Generate logs
+        id: branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          REPO="${{ github.repository }}"
+          RUN_ID="${{ github.run_id }}"
+
+          RUN_STARTED="${{ github.run_started_at }}"
+          if [ -z "$RUN_STARTED" ]; then
+            RUN_STARTED=$(gh run view "$RUN_ID" --repo "$REPO" --json startedAt --jq '.startedAt')
+            echo "Resolved run_started_at from API: $RUN_STARTED"
+          fi
+          echo "run_started_at=$RUN_STARTED" >> "$GITHUB_OUTPUT"
+
+          # Full-run logs are unavailable while the workflow is in progress;
+          # fetch logs from the completed generate job instead.
+          JOB_ID=$(gh run view "$RUN_ID" --repo "$REPO" --json jobs --jq \
+            '[.jobs[] | select(.name == "generate / Generate Target")] | .[0].databaseId // empty')
+
+          BRANCH=""
+          if [ -z "$JOB_ID" ]; then
+            echo "::warning::Could not find generate job id — auto-merge will use run_started_at fallback"
+          else
+            MAX_ATTEMPTS=12
+            INTERVAL=10
+            for attempt in $(seq 1 "$MAX_ATTEMPTS"); do
+              BRANCH=$(gh run view "$RUN_ID" --repo "$REPO" --job "$JOB_ID" --log 2>/dev/null \
+                | grep -oE 'branch_name=speakeasy-sdk-regen-[0-9]+' | tail -1 | cut -d= -f2 || true)
+              if [ -n "$BRANCH" ]; then
+                echo "Extracted branch_name=$BRANCH (attempt $attempt)"
+                break
+              fi
+              if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
+                echo "Job logs not ready — waiting ${INTERVAL}s (attempt $attempt/$MAX_ATTEMPTS)..."
+                sleep "$INTERVAL"
+              fi
+            done
+            if [ -z "$BRANCH" ]; then
+              echo "::warning::Could not extract branch_name from Generate logs after ${MAX_ATTEMPTS} attempts — auto-merge will use run_started_at fallback"
+            fi
+          fi
+          echo "branch_name=$BRANCH" >> "$GITHUB_OUTPUT"
+
+  auto-merge:
+    needs: [generate, resolve-branch]
+    if: ${{ !cancelled() && needs.generate.result == 'success' }}
+    uses: ./.github/workflows/auto-merge-speakeasy-pr.yaml
+    with:
+      run_started_at: ${{ needs.resolve-branch.outputs.run_started_at }}
+      branch_name: ${{ needs.resolve-branch.outputs.branch_name }}
+    secrets:
+      GH_DOCS_SYNC_APP_ID: ${{ secrets.GH_DOCS_SYNC_APP_ID }}
+      GH_DOCS_SYNC_APP_PRIVATE_KEY: ${{ secrets.GH_DOCS_SYNC_APP_PRIVATE_KEY }}