ci: authenticate SSE contract test downloads with GITHUB_TOKEN

[devin-ai-integration]

Summary

Contract test downloads were fully unauthenticated, so CI is subject to the shared-runner anonymous GitHub API rate limit. This already broke main: the 2026-07-22 run of CI (hyper-rustls-native-roots) failed with

GitHub token:  not provided (API requests may be rate-limited)
HTTP response: HTTP/2 403
Rate limit remaining: 0

(https://github.com/launchdarkly/rust-eventsource-client/actions/runs/29951809080)

.github/actions/ci now runs the contract tests through the standardized launchdarkly/gh-actions/actions/contract-tests action (same setup as swift-eventsource) instead of make run-contract-tests, with a new optional token input wired to secrets.GITHUB_TOKEN from ci.yml, release-please.yml, and manual-publish.yml. The action authenticates both the downloader fetch and the downloader's releases-API calls.

-    - name: Run contract tests
-      run: CARGO_FLAGS="..." make run-contract-tests
+    - name: Run contract tests
+      uses: launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1.3.0
+      with:
+        repo: sse-contract-tests
+        branch: main
+        version: v2
+        token: ${{ inputs.token }}
+        test_service_port: '8080'
+        debug_logging: 'true'
+        enable_persistence_tests: 'false'

The Makefile target is unchanged and still available for local runs.

Link to Devin session: https://app.devin.ai/sessions/bbaa402957474f3ab30fe102ed0316e2

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring