fix: trigger CLA workflow during bot PR review and auto-merge events

[k-alphonse]

Problem

Bot-created pull requests may not always trigger the CLA workflow when they are first opened.

In particular, workflows such as update_dev_guides.yml create pull requests using GITHUB_TOKEN. GitHub restricts which workflow runs can be triggered by events created with GITHUB_TOKEN, so the CLA check may not appear on these automated pull requests at the time they are opened.

This creates a merge-safety gap: the pull request can enter the normal review and merge process without the required CLA check being created.

Proposed fix

Update the CLA workflow trigger in .github/workflows/cla.yml so that it also runs on pull request events that occur during the normal human review and merge path.

Change:

on:
  merge_group:
  pull_request_target:
    types: [opened, reopened, synchronize]

to:

on:
  merge_group:
  pull_request_target:
    types: [opened, reopened, synchronize, auto_merge_enabled, review_requested]

Rationale

Automated pull requests still require human interaction before they can be merged, such as requesting review, approving changes, or enabling auto-merge.

Adding review_requested and auto_merge_enabled ensures the CLA workflow can run when those human-driven pull request events occur. This provides an additional opportunity for the required CLA check to appear before the pull request becomes mergeable.

This change does not alter the CLA validation logic itself. It only expands the pull request events that trigger the existing CLA workflow.

Acceptance criteria

• The CLA workflow continues to run on opened, reopened, and synchronize pull request events.
• The CLA workflow also runs on review_requested and auto_merge_enabled pull request events.
• The existing merge_group trigger remains unchanged.
• Bot-created pull requests can receive the CLA check during the normal review or auto-merge process.

[ph-kev]

Completed by #411