ci: check the changelog without checking out fork code

[Jahongir-Qurbonov]

Description

The changelog check currently fails on every pull request opened from a fork, regardless of whether a
newsfragment was added. actions/checkout now refuses to check out fork code from a
pull_request_target workflow:

Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs
with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access.
Fetching and executing a fork's code in that trusted context commonly leads to 'pwn request'
vulnerabilities.

Because the checkout step fails, towncrier check never runs, and the if: failure() step posts the
"Changelog is required!" comment even when the fragment is there. Recent examples: #1917 (has
CHANGES/1876.bugfix.rst) and #1916.

Fix

The workflow keeps running on pull_request_target, since commenting on fork pull requests needs a
token with write access, but it no longer checks out the fork:

• only the base repository is checked out, so the code that runs is always trusted;
• the list of changed files comes from gh api repos/{repo}/pulls/{number}/files;
• .github/scripts/check_changelog.py applies the same rules as towncrier check, reading the
  towncrier configuration (fragment directory, news file, categories) from the base repository's
  pyproject.toml, so the categories stay in one place;
• explicit least-privilege permissions are added (contents: read, pull-requests: write).

The pip install -U towncrier step goes away with it, so the job no longer depends on whatever
towncrier release is current.

The bot comment steps are unchanged.

Behaviour

The script matches towncrier check on the cases that matter:

changed files	result
code +CHANGES/1876.bugfix.rst	pass
code only	fail
CHANGES.rst (release build)	pass, checks skipped
CHANGES/.template.rst.jinja2 only	fail
CHANGES/1234.bugfixes.rst (typo in category)	fail
CHANGES/+orphan.misc.rst	pass
nothing	pass

Note

pull_request_target workflows run from the base branch, so this pull request will itself be checked by
the current, broken version of the workflow and its changes-required check will fail the same way.
The fix only takes effect once it is merged into dev-3.x.

Alternatives considered

• allow-unsafe-pr-checkout: true on the checkout step restores the old behaviour in one line, but it
  opts back into exactly the risk the guard describes: towncrier would read the fork's pyproject.toml
  and jinja2 template in a job holding the base repository's token.
• Splitting into a pull_request job plus a workflow_run job that comments is the other standard
  pattern, but it is a much larger change for the same outcome.

🤖 Generated with Claude Code

[github-actions]

❌ Changelog is required!

You need to add a brief description of the changes to the CHANGES directory.

Changes file should be named like <issue or PR number>.<category>.rst,
example 1234.bugfix.rst where 1234 is the PR or issue number and bugfix is the category.

The content of the file should be a brief description of the changes in
the PR in the format of a description of what has been done.

Possible categories are: feature, bugfix, doc, removal and misc.

[Olegt0rr]

Duplicate of #1884 and #1908