changelog: fetch scrubbed bundle from the CDN for the bundle PR flow

[cotti]

Important

Depends on elastic/docs-builder#3470 (adds the cdn_url plan output and the per-product entry registry). The bundle-fetch action fails clearly until that change ships to the docs-builder edge image, so merge/release that first.

Summary

Make changelog-bundle-pr.yml fetch-only. Instead of regenerating the bundle locally and committing whatever the runner produced, it downloads the already-uploaded, scrubbed copy from the public CDN and opens the PR with that — so the committed file matches exactly what was published to S3 (private references removed).

What changed

• New changelog/bundle-fetch composite action: resolves the plan (output_path + cdn_url), polls the CDN with exponential backoff (~5s → 60s cap, ~10 min budget) to absorb scrubbing + CloudFront propagation latency, then uploads the bundle as an artifact. Fails the job if the bundle never appears.
• changelog-bundle-pr.yml split into a read-only fetch job and a write create-pr job.
• bundle-pr: input descriptions (output, artifact-name) made source-agnostic, since the artifact can now come from either bundle-create or bundle-fetch.
• Docs: document CDN entry sourcing (bundle.use_local_changelogs) and the fetch-only PR flow across the changelog READMEs.

Rollout ordering

1. Merge & release changelog: source bundle entries from the CDN with a per-product registry docs-builder#3470 to edge.
2. Then merge this. The upload workflow (changelog-bundle.yml) must run for a product/version before the PR workflow can fetch it.

Test plan

• After docs-builder#3470 is on edge, run changelog-bundle.yml to upload a bundle
• changelog-bundle-pr.yml fetch job resolves cdn_url and downloads the scrubbed bundle
• Polling rides out scrubbing latency (no premature failure); a never-published bundle fails the job
• create-pr job opens a PR containing the fetched (scrubbed) bundle

Made with Cursor