Add CI workflow to validate newsfragment PR numbers (#62975)

* Add CI workflow to validate newsfragment PR numbers

Newsfragment files follow the naming convention `{pr_number}.{type}.rst`,
but nothing currently validates that the PR number in the filename matches
the actual PR number. This has led to cases where a contributor copies a
newsfragment from another PR or makes a typo, and the mismatch goes
unnoticed until a reviewer catches it manually.

The existing `scripts/ci/prek/newsfragments.py` validation script runs as
a local pre-commit hook where the PR number is not yet known, so it cannot
perform this check. Rather than extending that script with optional CLI
args and a separate CI invocation, this adds a standalone lightweight
workflow that uses `gh pr diff --name-only` to get the list of changed
files, greps for newsfragment `.rst` files, and checks that none have a
mismatched PR number — all in a single piped command, no checkout needed.

Notes for reviewers:
- `gh pr diff --name-only` includes deleted files. In practice, newsfragment
  deletions only happen during towncrier releases on main, not in contributor
  PRs, so this is not a concern for the `pull_request` trigger.
- `GH_TOKEN: ${{ github.token }}` follows the same pattern as
  `milestone-tag-assistant.yml` and `backport-cli.yml` which also call `gh`
  CLI directly.
- The `pull-requests: read` permission is required for `gh pr diff` to work
  on fork PRs.

* fixup! Add CI workflow to validate newsfragment PR numbers

fixup! Add CI workflow to validate newsfragment PR numbers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>