After saving the auto action there should be parameter below the auto action URL on the global tab to disable direct access. Be sure you've no triggers selected when doing this as should be the case for actions 1 and 2 in my explanation. This allows those actions to only be called via APIs and not via URL.

You mention "it MUST have the same conditions as the cb_gifts field" but cb_gifts field does not have any conditions!

Sorry, it should have the same conditions as your Custom HTML field.

You also say "for Output use a redirect to redirect back to the displayed users profile". How is this done. There is just a text field in redirect output.

Set the redirect URL to the following and it'll send them back to their profile.

[cb:url location="profile_view" /]

"In the Custom HTML field you'd just create a button that links to Action 3." How to create this button and what the link will be?

Just using plain old HTML. Example as follows.

User A buys the gift plan. The cb_gifts field is updated and he can view the link to auto action 3 that will trigger auto actions 1 and 2. He clicks on it, the procedure works, but the gift subscription is added to himself.... not to User B.

You need to add &users=[user_id] to your action URL so the auto action knows what profile to gift to.

Probably also worth adding a condition to the field and your action to make sure the viewing user and action user are not the same user to prevent that from happening as well. Below should work.

Field: Custom > Value
Custom Value: [cb:userdata field="user_id" user="#me" /]
Operator: Not Equal To
Value: [user_id]