fix(ci): changelog workflow for protected master

[Copilot]

The update-changelogs Actions job was failing because it still tried to push generated changelog commits directly to protected master. This change moves the automation onto a PR-based path while preserving the existing changelog generation and file-scope guardrails.

• Workflow change

  • Replace direct git push origin HEAD:master in .github/workflows/changelog-master.yml with peter-evans/create-pull-request.
  • Grant the job pull-requests: write so it can open or update an automation PR against master.
  • Use a stable automation branch: automation/update-changelogs.

• Behavior preserved

  • Keep the existing changelog refresh steps unchanged.
  • Keep the validation that fails if the generator modifies anything other than CHANGELOG.md files.
  • Only create a PR when changelog files actually changed.

• Documentation

  • Update Tooling/scripts/README.md to describe the new protected-branch-safe flow.

- name: Open changelog update pull request
  if: steps.changes.outputs.has_changes == 'true'
  uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
  with:
    branch: automation/update-changelogs
    base: master
    commit-message: "docs: update unreleased changelogs"
    add-paths: |
      CHANGELOG.md
      **/CHANGELOG.md

[Copilot]

🟢 Approval recommended

The workflow change cleanly replaces protected-branch pushes with a PR-based path while preserving the existing change-detection and file-scope validation logic.

Pull request overview

This PR updates the changelog-master GitHub Actions workflow to be compatible with a protected master branch by switching from direct pushes to a PR-based automation flow, while keeping the existing changelog generation and “only CHANGELOG.md files changed” guardrails intact.

Changes:

• Replace direct git push ... master publishing with peter-evans/create-pull-request targeting master via automation/update-changelogs.
• Add pull-requests: write permission and gate PR creation on detected changelog changes.
• Update scripting documentation to describe the new PR-based workflow behavior.

File summaries

File	Description
.github/workflows/changelog-master.yml	Switches changelog publishing from protected-branch pushes to opening/updating an automation PR against master.
Tooling/scripts/README.md	Documents the updated CI behavior (refreshes changelogs and then opens an automation PR).

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.