Build/Test Tools: Prepare for GitHub's default block on `pull_request_target`

Description

GitHub is adding a default Actions event policy that disables pull_request_target on public repositories with no applicable policy. Evaluate mode now, enforced on 2026-11-02. It blocks the event, not the workflow file, so other triggers survive.

Gutenberg qualifies unless WordPress already has an org-level policy. None of the six affected workflows check out pull request head code; each uses the event only for a writable token on fork pull requests. wordpress-develop is affected too, with two more workflows: see #66139.

Workflow	Impact on 2026-11-02
enforce-pr-labels.yml	Stops. Fork pull requests unmergeable if Check the type label is required.
pr-labeling-automation.yml	Stops.
cherry-pick-wp-release.yml	Stops. Backports become manual.
required-changes-from-trunk.yml	check-pr stops. Daily backfill survives.
pull-request-automation.yml	Welcome comment stops. push jobs survive.
props-bot.yml	Degraded. Comment and review triggers survive.

Proposed action

1. Confirm no org-level policy already covers WordPress.
2. Check trunk branch protection for Check the type label and Required changes from trunk, the only merge-blocking impact.
3. Use Settings > Actions > Policies > Insights before 2026-11-02 to confirm the blocked set.
4. Add a policy allowing the event, narrowed to these six files with workflow file targeting.

Tracked for Core in #66139.