feat(ci): auto-trigger make-release and docs rebuild on PR merge

[svozza]

Summary

Follow-up to #5451 (merged as #5462). Removes the last two manual triggers in the release pipeline by adding a new workflow that auto-dispatches the next step when the version-bump PR or the layer ARN-doc PR merges to main.

Changes

• Add .github/workflows/on_release_pr_merge.yml:
  • trigger-make-release: dispatches make-release.yml when a merged PR's branch matches ci-bump-* (opened by make-version.yml)
  • trigger-rebuild-docs: dispatches rebuild_latest_docs.yml with the version resolved from packages/commons/package.json when a merged PR's branch matches ci-layer-docs-* (opened by publish_layer.yml's update_layer_arn_docs job)
• Update docs/maintainers.md's release checklist to describe Make Release and Rebuild latest docs as automatically triggered by PR merge, since manual dispatch is no longer needed

Security considerations

This workflow can dispatch make-release.yml (real npm publish) and rebuild_latest_docs.yml (real writes to production docs), so the trigger conditions are deliberately strict and layered:

• pull_request, not pull_request_target: runs with the default read-only GITHUB_TOKEN and no secrets in context for the triggering event itself. A PR from a fork could never reach the gh workflow run step even if every other condition below happened to match.
• head.repo.full_name == github.repository: explicitly rejects PRs opened from forks, independent of the author check below.
• pull_request.user.login == 'github-actions[bot]': this is the actual GitHub-assigned identity of whoever called the API to open the PR — not spoofable via branch name, PR title, or body. Verified against real PR history that both ci-bump-* and ci-layer-docs-* PRs are opened by aws-powertools/actions' create-pr action using the default GITHUB_TOKEN, so .user.login is always github-actions[bot]. This is deliberately not aws-powertools-bot — that name only shows up as the git commit author, set locally by create-pr via git config, and is unrelated to what GitHub exposes as the PR's author.
• Exact branch-prefix match (ci-bump-/ci-layer-docs-): scopes each job to the one specific automation flow it should react to, so an unrelated PR merge (e.g. a dependabot bump) can't accidentally trigger a release step even if it somehow satisfied the other conditions.
• Least-privilege job permissions: permissions: {} at the workflow level, with each job granted only what it needs (actions: write to dispatch; contents: read added only for the job that checks out main to read the published version).

Design and end-to-end behavior — including the negative case, where an unrelated PR merge correctly leaves both jobs skipped — were verified on a private staging fork prior to this PR, since dispatching for real against this repo would trigger real npm publishes and AWS/S3 writes.

Issue number: closes #5455

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[dreamorosi]

Thanks for the PR - left a couple notes in the workflow file.