JGC-499 - Replace 'safe to test' label with single build-gate environment approval

[ehl-jf]

Summary

Replaces the per-workflow safe to test label gate with a single build-gate GitHub Environment deployment approval. A maintainer approves once per fork/PR run, and that single approval releases frogbot and all integration-test suites. Trusted push to master and manual workflow_dispatch runs skip the approval entirely.

What changed

• New build-gate.yml orchestrator (name: Build Gate)
  • Triggers: pull_request_target [opened, synchronize, reopened], push to master, workflow_dispatch.
  • A single gate job carries environment: ${{ github.event_name == 'pull_request_target' && 'build-gate' || '' }} — only fork/PR runs hit the environment and wait for approval; push/workflow_dispatch resolve to an empty environment (no gate).
  • 26 suite jobs (frogbot + go + 24 others), each needs: gate + uses: ./.github/workflows/<suite>.yml + secrets: inherit.
  • A build-gate-success aggregator job (needs: all suites, if: always()) that fails if any suite failed/was cancelled — see required-checks note below.
• 26 workflows converted to reusable (frogbot-scan-pull-request.yml + 25 *Tests.yml)
  • on: → workflow_call: + workflow_dispatch: (dropped push and pull_request_target: [labeled]).
  • Removed the safe to test job conditions. workflow_dispatch inputs preserved (incl. poetry's poetry_version); env:/permissions: blocks intact.
  • frogbot no longer declares its own environment: frogbot — the gate now lives in the orchestrator.
  • evidenceTests and ghostFrogTests keep their existing if: false (independently disabled).
• Deleted removeLabel.yml — the label mechanism it served is gone.

Security model

• Approval happens in gate, before any job checks out PR head code or touches secrets.
• Under pull_request_target, local uses: reusable workflows resolve from the base ref, so a PR cannot alter the gate or workflow logic — only the executed test/product code, which is exactly what the approval covers.

Recovering a failed run

Use "Re-run failed jobs": it re-runs the failed suite(s) and build-gate-success (reusing already-passed suites) while not re-running gate, so no re-approval and no new commit are needed — the single required check flips green on the same SHA. ("Re-run all jobs" re-runs gate and re-triggers approval.)

⚠️ Manual repo-settings changes required (not in this PR)

1. Create the build-gate Environment (Settings → Environments) with Required reviewers = the maintainer team.

2. Verify frogbot secrets are repo/org-level, not scoped to the old frogbot environment. frogbot no longer declares an environment and receives secrets via secrets: inherit (which passes repo/org secrets, not environment secrets). If FROGBOT_URL, FROGBOT_ACCESS_TOKEN, JF_SMTP_* were stored as frogbot-environment secrets, move them to repo/org level (or onto build-gate).

3. Repoint branch-protection required status checks to the single aggregator:

   • Build Gate / build-gate-success

   Remove the stale old per-workflow contexts. The aggregator is the only check that needs to be required — it transitively gates every suite, is matrix-independent (won't break when a suite's matrix changes), and stays pending until the approval gate is released.

4. (Optional cleanup) Delete the safe to test label and retire the now-unused frogbot environment.