Document the workflow run-as identity, including run as initiator

[GabeWM]

What does this PR do? What is the motivation?

Updates the Workflow Automation Workflow identity documentation for the release that lets a workflow run as the person who triggered it. The page described only two identities (owner and service account) and a settings menu that no longer exists.

content/en/actions/workflows/access_and_auth.md:

• Rewrites the Workflow identity intro to explain what the Run as identity controls (connection resolution, resource access, attribution), and summarizes the three identities: Owner (the default), Initiator, and Service Account.
• Adds Set the workflow identity, covering the current path (cog icon > Edit permissions > Run as), who can select each option, and where the active identity appears in the editor.
• Adds a parallel section for each identity: Run as the owner, Run as the initiator, and Run as a service account. Each one explains whose permissions a run uses and which permissions that identity needs to resolve the workflow's connections.
• Replaces the service account step lists (Associate, View, Change, Remove) with the single set of instructions in Set the workflow identity, because the service account is now attached in the same Edit permissions modal. The old Manage ownership and identity > Run as Service Account menu is no longer reachable from the workflow editor.
• Updates the workflow permissions steps for the editor, where granular access now lives under Who has access > Custom.

content/en/actions/workflows/trigger.md:

• Updates the workflow identity sentence and the further reading link, which both described only the owner and service account identities.

Anchor change to be aware of: #use-a-service-account becomes #run-as-a-service-account, so that the three identity sections read consistently. The in-repo link in trigger.md is updated. #workflow-identity, #workflow-permissions, #restrict-access-on-a-specific-connection, and #restrict-access-on-a-specific-workflow are unchanged.

Merge readiness

• Ready for merge

For Datadog employees:

• Branch name follows the <name>/<description> convention.

AI assistance

Drafted with Pi (AI-assisted research, manually reviewed). The wording was checked against the workflow run-as implementation and the current workflow editor UI strings.

Additional notes

The French translation of trigger.md still links to #use-a-service-account; that link now lands at the top of the page until translations are refreshed.

No Jira ticket is linked yet; happy to add one and rename the PR title to [DOCS-XXXXX] ... if the docs team wants it tracked.

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/gabriel.margolis/workflow-run-as-initiator/actions/workflows/access_and_auth
• https://docs-staging.datadoghq.com/gabriel.margolis/workflow-run-as-initiator/actions/workflows/trigger

[joepeeples]

Added a few edit suggestions. Also, the PR description flags that the Initiator identity is currently gated behind a feature flag per org. If it's not fully rolled out when you plan to publish this, the Run as the initiator section needs a Preview callout.

[GabeWM]

Added a few edit suggestions. Also, the PR description flags that the Initiator identity is currently gated behind a feature flag per org. If it's not fully rolled out when you plan to publish this, the Run as the initiator section needs a Preview callout.

@joepeeples Thanks for the review Joe. Unfortunately, that is the agent looking at the code and seeing the FF. I have not had a chance to clean it up, but this has been rolled out everywhere for some time and cannot be rolled back (would break customers actively using this).