chore(ci): route backports through verified pr metadata - #4264

What issue type does this pull request address? (keep at least one, remove the others)
/kind bugfix

What does this pull request do? Which issues does it resolve? (use resolves #<issue_number> if possible)
Remove privileged PR triggers from every workflow. Use an unprivileged, no-op pull_request label signal and trusted default-branch consumers that resolve merged PRs from GitHub's API. Merges use push; labels added after merge use workflow_run, avoiding duplicate close-event backports.

Give code-running PR jobs read-only tokens and disable stored checkout credentials. Gate jobs that need secrets, OIDC or write access on the PR head repository matching this repository. Same-repository PRs retain their CI and automation. Pin Helm 3 for the existing chart test plugin and retain the four workspace metadata files produced by go mod vendor, so the required checks can run on current tooling without relaxing them.

Closes DEVOPS-1803

Please provide a short message that should be published in the vcluster release notes
Keep automatic backports running through an unprivileged PR signal and verified merged PR metadata.

What else do we need to know?

The shared resolver and reusable backport workflow are published from loft-sh/github-actions#349 as resolve-pr-event/v1 and backport/v2. The reusable workflow uses resolve-pr-event/v1 internally. That shared resolver verifies the run's head_repository.full_name against the API-fetched PR's head.repo.full_name, as well as the workflow identity, branch, SHA, attempt, merge state and default-branch ancestry. No policy exception for privileged PR events is needed.

The read-only token, API validation, default-branch checks and shared resolver replay tests cover the privilege boundary. The new local workflow contract tests guard the signal, published references, matrix handoff and fork job permissions. Existing shared backport actions own mutations and status comments; no new service or alert route is added.

Validation: five workflow contract tests pass; actionlint passes with a narrow ignore for the pre-existing cache-mode key unsupported by local actionlint v1.7.12; offline zizmor reports zero dangerous-triggers findings, with fewer existing permission/checkout findings. The retained cache-mode: none is valid GitHub workflow syntax. Helm tests pass all 238 tests in 21 suites. ./hack/test.sh passed the Go build, race tests and coverage checks. The full custom ./tools/golangci-lint run --timeout 15m -- ./... passed with 0 issues after rebuilding with the Go version from go.mod. A clean local go mod tidy && go mod vendor reproduced the four workspace files reported by CI, with no change to go.mod or go.sum; those generated files are now committed. go list -mod=vendor ./... passes. The chart job now pins Helm v3.22.1 because the runner default requires plugin verification unsupported by the existing helm-unittest v0.4.4 plugin. Final CI for 73279ec1db29db168fb4f984d116d4e67e894149: 19 successful checks and 2 expected skips; all workflow runs completed, including the code-triggered Ginkgo run and install/upgrade checks. Live post-merge backport acceptance remains pending rollout. The matching monorepo staging patch will be handed to the owner of vcluster-pro#2695.

E2E Tests

Default Test Execution

The mandatory PR suite runs automatically. Only specify additional test suites below if needed.

Adding New Test Suites

When adding a new ginkgo test suite:

• Add labels to the test suite
• Update label-filter section below to execute the new test suite
• Verify test suite runs in CI/CD pipeline

Additional test suites

Additional test suite(s) that will be executed before the mandatory PR suite:

none