[M0] Add a required Plan Gate workflow

[arthurpanhku]

Goal

Reject planless changes and surface risk before code reaches the merge gate.

Scope

• Add a required Plan Gate GitHub Actions workflow.
• Validate meaningful pull request fields.
• Classify changes as low, medium, high, or critical risk using deterministic path and content rules.

Acceptance criteria

• Missing or placeholder required fields fail with actionable messages.
• Risk classification is deterministic and published in the job summary.
• Workflow, authentication, infrastructure, migration, and production-impacting changes cannot be classified low risk.
• Unit fixtures cover passing and failing pull request bodies plus each risk tier.
• The check is safe for pull requests from forks and does not execute untrusted code with write credentials.

Dependencies

Uses the headings introduced by the pull request template and becomes required in the main ruleset.