CI: fix access-token scope for get-next-version-code.sh

[Mansimran Singh (Mansimran-Singh)]

Summary

• CI: fix Play Console edit auth scope and silent versionCode fallback #685's access_token_scopes fix on the google-github-actions/auth step was a no-op. Confirmed against the action's own docs: access_token_scopes only affects the action's access_token output, which only exists when token_format: access_token is set. Without it, get-next-version-code.sh's gcloud auth print-access-token reads the ADC credentials file directly and mints its own token, ignoring that setting entirely — and gcloud auth print-access-token has no --scopes flag to override it (confirmed against the gcloud CLI reference), so the token stayed scoped to the generic cloud-platform default, which the Android Publisher API's edits.insert rejects.
• Fix: set token_format: access_token on the auth step so it actually produces a scoped access_token output, and pass that into get-next-version-code.sh via $ACCESS_TOKEN instead of shelling out to gcloud.
• Also made the script print the actual Play API error response body when edit creation fails, instead of a generic message — the last two real failures both required pulling raw workflow logs to diagnose; this puts the actual cause directly in the log next time.

Ticket

Related to #626

Type of Change

• New feature
• Bug fix
• Refactor
• Tests
• CI/CD
• Documentation

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed

CI workflow/script change, no unit-testable logic. Verified the two candidate root causes (access_token_scopes requiring token_format, and print-access-token having no --scopes flag) against google-github-actions/auth's and gcloud's own documentation rather than guessing again after the last fix turned out to be inert. Real validation happens on the next merge to main.

Checklist

• Tests pass locally (./gradlew testDebug)
• No API keys or secrets in code
• CLAUDE.md updated (if new pattern introduced)