Move verify_migrations to pull_request-triggered stage

[aeshub]

Summary

• Move verify_migrations job from migration_actions.yml (workflow_run stage) to migration_checks.yml (pull_request stage)
• Remove the now-unused update_success_message env var from migration_actions.yml

Why

Jobs in workflow_run-triggered workflows run against the default branch SHA, not the PR head SHA. This means verify_migrations was executing correctly but its status was not reported as a PR check, making it impossible to use as a required status check in branch protection.

By moving it to the pull_request-triggered stage, the job runs in the PR context and its status appears in the PR checks tab.

Consumer repo changes

The reusable migration_checks.yml now requires pull-requests: read and issues: read permissions (for peter-evans/find-comment). The following PRs add these permissions:

• equinor/flotilla#2688
• equinor/isar#1125 (updated)
• equinor/sara#319 (updated)