ci: Restore changelog-preview workflow with hardened craft 2.26.2 (#6056)

* ci: Restore changelog-preview workflow with hardened craft 2.26.2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: Drop unnecessary secrets: inherit from changelog-preview

The reusable workflow only references secrets.GITHUB_TOKEN, which is
auto-provisioned per job. Inheriting all repo secrets under
pull_request_target is unnecessary exposure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: antonis

.github/workflows/changelog-preview.yml

@@ -0,0 +1,17 @@
+name: Changelog Preview
+on:
+  pull_request_target:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - edited
+    - labeled
+    - unlabeled
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  changelog-preview:
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@3dc647fee3586e57c7c31eb900fdec7cbb44f23f # v2.26.2