CI: add review-gate check on pull requests

[matt-manuel]

Adds .github/workflows/review-gate.yml — this is the very first GitHub Actions workflow in this repository (there were previously no .github/workflows at all; PR checks here have come only from the external Codacy app, which this does not touch or replace).

It's a visible, non-required check that fails when a pull request carries neither an adversarial-reviewed nor a review-exempt label. It re-runs automatically on label changes and on title edits (e.g. fixing a "DO NOT MERGE" title), and auto-passes dependabot PRs, dependency-bump PRs, drafts, and PRs titled DO NOT MERGE — those never need a human review label.

This is deliberately NOT a required check. It makes review status visible at the merge button without ever blocking a merge; whether to make it required is a separate decision for later.

This is a copy of a centrally maintained workflow used across our repos, already reviewed before being rolled out here — see the review-exempt label and the comment on this PR.

Note: GitHub Actions is in a major outage today (confirmed via githubstatus.com — the Actions component is showing a major outage). This check will likely first report late or not at all until Actions recovers. Live verification — watching the check fail on an unlabeled PR, then pass once labeled — will happen after recovery, not as part of this PR.

[matt-manuel]

review-exempt: verbatim copy of a centrally reviewed CI workflow; per-repo delta is comments-only.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}