chore: Use pull_request_target for changelog preview

[BYK]

Summary

Updates the changelog-preview workflow to use pull_request_target instead of pull_request.

Why?

This change is required for the changelog preview to work correctly with PRs from forks. With pull_request, the workflow runs with a read-only GITHUB_TOKEN which cannot post comments or create statuses on fork PRs.

This aligns with the recommended usage in the craft changelog-preview workflow.

Security Note

This change is safe because the changelog-preview workflow:

• Downloads the Craft binary from releases (not from the PR)
• Only reads git metadata and configuration
• Does not execute any code from the PR

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Privileged workflow trigger with inherited secrets needs verification

Medium Severity

The change to pull_request_target combined with secrets: inherit and write permissions (contents: write, pull-requests: write) creates a privileged execution context for fork PRs. This is a known security-sensitive pattern ("pwn request"). The safety depends entirely on the external workflow at getsentry/craft/.github/workflows/changelog-preview.yml@v2 not executing PR-controlled code or processing untrusted inputs unsafely. The PR's security claims about that workflow cannot be verified from this diff alone and warrant independent confirmation.

Additional Locations (1)

• .github/workflows/changelog-preview.yml#L16-L18