fix(ci): check out the repo for the /changelog Claude step (#10865)

* fix(ci): check out the repo for the /changelog Claude step

The claude-code-action performs git operations (configure user, fetch origin
main) that assume a checked-out repo. The changelog-command workflow had no
checkout, so the step failed with git exit code 128 and, being continue-on-error,
silently posted the fallback comment instead of a draft. Add a checkout of the
default branch (never PR head, persist-credentials off); the PR content is still
supplied only as the diff passed to the prompt.

* fix(ci): check out the repo for the /changelog Claude step

The claude-code-action performs git operations (configure user, fetch origin
main) that assume a checked-out repo. The changelog-command workflow had no
checkout, so the step failed with git exit code 128 and, being continue-on-error,
silently posted the fallback comment instead of a draft. Add a checkout of the
default branch (never PR head, persist-credentials off), and grant contents: read
so the job token can fetch; the PR content is still supplied only as the diff.

Author: gustavovalverde

.github/workflows/changelog-command.yml

@@ -28,6 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: Acknowledge the command
@@ -39,6 +40,12 @@ jobs:
           set -euo pipefail
           gh api --method POST "repos/${REPOSITORY}/issues/comments/${COMMENT_ID}/reactions" -f content=+1 >/dev/null || true
 
+      # issue_comment checks out the default branch (never PR head), giving the Claude action
+      # a git repo to operate in. The PR content is supplied as the diff below, not from here.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - name: Collect the PR diff
         id: diff
         env: