ci: open changelog PR instead of pushing to protected branch

The release-triggered Changelog workflow was pushing the CHANGELOG.md
update directly to 4.x via stefanzweifel/git-auto-commit-action. Branch
protection on 4.x ("Changes must be made through a pull request") rejects
that push, so every release since v4.0.10 has shipped without its
CHANGELOG entry.

Swap the commit-and-push step for peter-evans/create-pull-request, which
opens a PR from chore/changelog-<tag> with the skip-changelog label, then
enable auto-merge (squash) so the PR lands without human intervention.
4.x has no required status checks and 0 required reviews, so auto-merge
clears immediately.

Also tag the PR with skip-changelog so it's excluded from the next
release's auto-generated notes (per .github/release.yml).

Author: ManukMinasyan

.github/workflows/changelog.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   update:
@@ -34,9 +35,23 @@ jobs:
           latest-version: ${{ github.event.release.name }}
           release-notes: ${{ github.event.release.body }}
 
-      - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v7
+      - name: Open changelog PR
+        id: cpr
+        uses: peter-evans/create-pull-request@v7
         with:
-          branch: ${{ steps.branch.outputs.name }}
-          commit_message: Update CHANGELOG
-          file_pattern: CHANGELOG.md
+          base: ${{ steps.branch.outputs.name }}
+          branch: chore/changelog-${{ github.event.release.tag_name }}
+          delete-branch: true
+          commit-message: "chore: update CHANGELOG for ${{ github.event.release.tag_name }}"
+          title: "chore: update CHANGELOG for ${{ github.event.release.tag_name }}"
+          body: |
+            Auto-generated CHANGELOG update for release ${{ github.event.release.tag_name }}.
+
+            Release notes: ${{ github.event.release.html_url }}
+          labels: skip-changelog
+
+      - name: Enable auto-merge
+        if: steps.cpr.outputs.pull-request-operation == 'created'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}"