chore(ci): remove the Autopilot bulk-update-cli job [FSM-1137]

[pgragg]

What

FSM-1137. Remove the bulk-update-cli job from the CLI release workflow.

The job sent POST $AUTOPILOT_HOST/api/bulk-update-cli after each successful
CLI publish, with AUTOPILOT_HOST defaulting to
https://autopilot.buildwithfern.com.

Research in FSM-352 shows that Autopilot must not move to the Postman AWS
account. The job is the last daily caller of Autopilot from this repository,
so it must go before Autopilot can be switched off.

Why this is safe

• The publish itself completes in the earlier prod job. bulk-update-cli
  runs after it and only starts a fan-out of CLI version bump pull requests to
  onboarded config repositories.
• The step exits 1 when the response is not 2xx. If we leave the job in
  place, the CLI release workflow turns red on every publish as soon as
  Autopilot stops answering. CLI publishes happen almost every day.
• No other job uses needs: [bulk-update-cli], so removing it does not change
  any other job.
• The job was the only user of vars.AUTOPILOT_HOST in this repository. A
  code search for AUTOPILOT_HOST, bulk-update-cli, and
  autopilot.buildwithfern.com returns only this workflow.

The permissions block stays as it is. contents: read and id-token: write
are still needed for checkout and for OIDC publishing in the other jobs.

Effect on customers

Onboarded config repositories stop receiving an automatic CLI version bump
pull request. That fan-out was an early-access feature. It is blocked by
default by a per-repository PostHog flag, and only three of its pull requests
have merged into a named customer repository, the last one on 2026-05-12.

Not in this change

No infrastructure change. The Autopilot ECS services, RDS instance,
ElastiCache cluster, S3 buckets, Lambda function, and the AUTOPILOT_*
PostHog flags stay as they are.

The "autopilot" value of the InvocationSource IR enum stays. It is a
generated type, not a call to the service.

Test plan

Merge, then confirm that the next Publish Fern CLI run finishes green and
makes no request to Autopilot.

Ticket: https://postmanlabs.atlassian.net/browse/FSM-1137

---

Why this PR is in fern-api

fern-api/fern is the CLI and generators monorepo and has no postman-eng
mirror, so a workflow change has to land here. Checked with
gh search code --owner postman-eng "pnpm seed publish cli" (empty) and
gh search repos --owner postman-eng fern (no sdk-gen-fern).

Review follow-ups

• Scope corrected to chore(ci): the diff only touches .github/workflows/.
  Both scopes pass lint-pr-title.yml.
• Checked the two open review follow-ups that need repo settings rather than the
  diff:
  • gh api repos/fern-api/fern/actions/variables lists only TURBO_TEAM, so
    there is no repository-level AUTOPILOT_HOST left to delete. An org-level
    variable would still be readable by this workflow, but reading org variables
    needs admin:org, so someone with that scope should confirm.
  • No required status check is named bulk-update-cli. Verified against
    branches/main/protection and both rulesets (Mainline Protection, main),
    which require only biome, lint, compile, depcheck,
    Validate versions.yml files, test, test-ete, and the
    seed-test-results (*) matrix. Removing the job cannot block a merge.

[nitpickybot]

Straightforward removal of the bulk-update-cli job from the CLI publish workflow. No other job references it via needs, no leftover env/vars usage, and the deletion is self-contained. Nothing to flag.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pgragg]

Superseded by #17477 — same branch, same one-file diff.

I amended this commit's message inside a shallow clone (--depth 1), which wrote the amended commit with no parent. The pushed branch then shared no history with main, so GitHub closed this PR, and it refuses to reopen a PR whose branch was force-pushed after closing. The branch is now rebuilt on top of main from a full-history clone, with a byte-identical tree, and review continues in #17477.