[ML] Sweep stale backport-pending labels (auto-merged backports)

[edsavage]

Summary

The remove-backport-pending job in backport.yml clears the backport-pending label from a source PR once all of its backports have merged. It's driven by the backport PR's closed(merged) event.

That event-driven path never fires when a backport PR is auto-merged: auto-merge is armed with GITHUB_TOKEN, so GitHub attributes the eventual merge to github-actions[bot] and suppresses the workflow runs it would otherwise trigger — the same recursion guard that stops GITHUB_TOKEN-authored PRs from starting CI (already documented in the backport job). The upshot is the source PR keeps backport-pending indefinitely and it has to be removed by hand (as happened on #3078 and #3115).

Fix

Add an hourly (and workflow_dispatch) sweep-backport-pending backstop job that clears backport-pending from any source PR whose backport PRs have all merged/closed. It:

• is independent of how the backports merged (auto-merge, manual, admin bypass), and also covers manually created backports;
• reuses the same title-reference convention ([9.5] Original title (#<source>)) as the event-driven job;
• includes a 1-hour post-merge guard so it never strips the label in the small window before the backport PRs have been opened.

The event-driven job is retained (immediate in the human-merge case); the sweep is purely additive.

Notes

• New triggers schedule + workflow_dispatch are added. The existing pull_request_target jobs are guarded on github.event.pull_request.*, so they're skipped for schedule/dispatch events (and the sweep job is gated to only those events).
• Depends on backport PR titles carrying (#<source>) — same assumption as today's remove-backport-pending. Manually opened backports should follow that convention to be tracked.

Test plan

• Merge to main.
• Trigger the workflow manually (workflow_dispatch) and confirm the sweep-backport-pending job runs, correctly keeps the label on a source PR that still has open backports (respecting the 1h guard), and removes it once all backports are merged/closed.
• After a real auto-backport round completes (all backports auto-merged), confirm backport-pending is cleared within the hour without manual intervention.

Follows up the auto-backport-and-merge work (#3094, #3103, #3122); addresses the known GITHUB_TOKEN-suppression cleanup gap noted there.

[elasticsearchmachine]

Pinging @elastic/ml-core (Team:ML)

[edsavage]

Superseded by #3128, which fixes the root cause directly: arm auto-merge with the ephemeral App token so the deferred merge is attributed to a non-github-actions[bot] identity and therefore triggers remove-backport-pending normally. That's the GitHub-recommended remedy (and what kibana gets for free via kibanamachine), so the scheduled sweep here is no longer needed.