Fix carrier-api update workflow

[Snuffy2]

Summary

Reworks the carrier-api dependency update workflow so the complex update, release-note, and stale-branch cleanup logic lives in checked-in Python helpers with regression coverage.

What Changed

• Replaced inline shell and actions/github-script workflow logic with Python helper scripts under .github/scripts.
• Added carrier-api pin update handling for manifest and pyproject pins, stable PyPI release selection, and prerelease/drift scenarios.
• Added release-note PR body generation with mention and closing-keyword sanitization.
• Added cleanup logic for stale workflow-owned PRs and branches.
• Hardened the update workflow checkout with persist-credentials: false.
• Added tests covering workflow surface expectations, updater behavior, release-note generation, error handling, and cleanup behavior.

Why

Keeping workflow business logic in tested Python helpers makes the nightly dependency update easier to validate locally, reduces quoting risk in YAML, and gives future review feedback a concrete regression-test surface.

Validation

• ./.venv/bin/pytest tests/test_update_carrier_api_workflow.py --no-cov
• ./scripts/lint
• ./.venv/bin/pytest

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.