[DOCS-15378] Add scheduled blog linker workflow

[jeff-morgan-dd]

What does this PR do? What is the motivation?

Fixes DOCS-15378

Adds a scheduled workflow that runs the blog linker script every Tuesday and opens a draft PR on a branch with the result, plus the dd-octo-sts trust policy it needs.

The blog linker script adds Datadog blog post links to the further_reading section of the docs pages those posts reference. It has been run manually on a regular basis; this action automates the run itself. The output opens a draft PR on a branch for manual review prior to the standard docs PR review process.

Two files:

• .github/workflows/blog_linker.yml — the weekly job run via cron
• .github/chainguard/documentation.blog-linker-write.sts.yaml — the trust policy that lets it push a branch and open the PR

The script lives in DataDog/websites-images (services/webops-site-build/bin/docs-ci/blog_linker.py) and is fetched at run time, per the convention that build scripts live in the image rather than the docs repo. The companion PR adding the matching read policy there is DataDog/websites-images#479.

About the write permission

The policy grants contents: write and pull_requests: write, which the job needs to push its branch and open the PR.

It is pinned as narrowly as the claims allow:

• Only this repo
• Only from refs/heads/master
• Only schedule or workflow_dispatch events
• Only when the running job is blog_linker.yml@refs/heads/master

A PR that adds a workflow, or any run from a feature branch, matches nothing and gets no token. Tokens are short-lived and expire with the job.

Written to follow the SECENG guidance in High-level recommendations for ID token verification:

• GitHub issuer verified
• subject, ref, ref_type, event_name, and job_workflow_ref all specified
  -- ref_protected is deliberately omitted, since it is true on all branches org-wide and no longer narrows anything
• All actions are pinned to commit SHAs and id-token: write is scoped to the single job

Testing

After both PRs merge, I'll run a manual workflow_dispatch with dry_run: true, which reports what it would change without opening a PR. The workflow can't run from a branch.

Merge readiness

• Ready for merge

For Datadog employees:

• ⚠️ Your branch name MUST follow the <name>/<description> convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR.
• 🤖 New: Comment with /review to run an automated check that catches common issues before a Documentation team member reviews your PR.

AI assistance

Lots of Claude and Codex for writing and testing, with guidance and final review from me.

Additional notes

Nothing lands under hugo/, so there is no site build impact.

[StefonSimmons]

Looks great! 👍