Gate CI to ready, up-to-date pull requests

[mgballou]

• Limited CI to pull_request events (opened, synchronize, reopened, ready_for_review) and removed the push trigger on main
• Added a gate job with a job-level if so draft PRs show as skipped, never failed
• Passed the gate with a notice on a PR behind its base and skipped the check job through a gate output, so a stale branch never turns the run red
• Hung the check job on the gate through needs and an if on the gate output
• Capped the gate at 3 minutes and the check at 15 so a hang cannot burn hours of runner time
• Cancelled superseded runs through a concurrency group per PR number and draft state, falling back to the ref
• Added top-level permissions: contents: read
• Supersedes Guard CI minutes with a timeout, draft skip, and concurrency cancel #21, which this PR covers in full

Removed from CI

None. check is healthy: 28 of 30 recent runs passed, median 1.2 minutes, the 2 failures were real Prettier errors fixed on the next push. The repo is public, so check stays on ubuntu-latest. setup-node already caches pnpm.

Local checks

Each ran under gtimeout 600; the same scripts CI runs (pnpm typecheck, lint, test, build):

$ pnpm typecheck
apps/web typecheck: Done
$ pnpm lint
Checking formatting...
All matched files use Prettier code style!
$ pnpm test
 Test Files  63 passed (63)
      Tests  1371 passed (1371)
$ pnpm build
dist/assets/index-CWYfjpzc.js   350.28 kB │ gzip: 106.02 kB
✓ built in 503ms
$ workflow guard (local)
all workflows guard their minutes

[netlify]

✅ Deploy Preview for dreadmajesty ready!

Name	Link
🔨 Latest commit	3b8b65c
🔍 Latest deploy log	https://app.netlify.com/projects/dreadmajesty/deploys/6ac1111082be5d00083e0ca0
😎 Deploy Preview	https://deploy-preview-19--dreadmajesty.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[mgballou]

Local verification: current and green

Main da92b00319bcbb46bfc074e9bb81a221f7c6c1b4 is already included; merging origin/main reported already up to date. Verified/pushed head: 955cad5239126ad1d4cc2b65a164d8c5526bb144. HTTPS push reported everything up to date.

Node 26.7.0, pnpm 11.18.0, isolated worktree on a separate local branch to preserve the user's existing checkout. PATH began with /opt/homebrew/bin; each check/build used /opt/homebrew/bin/gtimeout 900 rtk proxy.

Command	Exit	Result
pnpm install --frozen-lockfile	0	Locked dependencies installed
NODE_OPTIONS=--no-experimental-webstorage pnpm check	0	README #20 command: typecheck/lint/format passed; 63 files / 1371 tests passed
pnpm build	0	Production build succeeded; no tests in this command

Recommend landing this CI gate last, after the other five PRs, so its requirement that branches be current does not intervene between those merges. Ready state unchanged. No PR merged.