chore(workflows): pre-merge changelog-trigger permission from master (#5270)

* chore(workflows): pre-merge auto-label and changelog-trigger from master

Adopts two changes that already exist on master so the eventual
v3-alpha → master merge has fewer conflicts to hand-resolve:

- auto-label-issues.yml: switch the PR trigger from `pull_request` to
  `pull_request_target` so the workflow can label PRs from forks
  (security hardening already in place on master).
- unreleased-changelog-trigger.yml: add the `actions: write` permission
  needed by the trigger step (already in place on master).

No behaviour change for v3-alpha-only paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(workflows): keep v3-alpha's pull_request_target on auto-label-issues

I had the direction backwards in the previous commit on this branch.
v3-alpha already uses pull_request_target (the security-hardened
trigger that lets the workflow label PRs from forks); master is the
one still on the older pull_request. The fix to auto-label-issues
belongs on master, not on v3-alpha. Reverting that part of this PR
so v3-alpha keeps its current behaviour. The unreleased-changelog
permission update remains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: leaanthony

.github/workflows/unreleased-changelog-trigger.yml

@@ -39,6 +39,7 @@ jobs:
     name: Trigger v3-alpha Release
     permissions:
       contents: read
+      actions: write
     runs-on: ubuntu-latest
     needs: check-permissions
     if: needs.check-permissions.outputs.authorized == 'true'