Introduce bot/CI policy workflows for contract and pin governance

[CMCDragonkai]

Problem

Automation and bot workflow phases were deferred. Repository-level policy operations remain mostly manual.

Intent

Move contract and pin-governance checks from mostly local/manual operation to repeatable CI policy workers.

Scope

• Add PR workflow gates for contract and policy checks.
• Add scheduled workflow for pin lifecycle visibility.
• Optionally add bot-assisted pin update proposal workflow.

Non-goals

• No broad platform automation beyond this repository.
• No runtime control-plane behavior in this issue.

Tasks

1. Add .github/workflows PR gate for nix flake check path:. --no-write-lock-file.
2. Add scheduled pin lifecycle workflow based on existing scripts/checks.
3. Define workflow output artifacts and failure policy.

Acceptance criteria

• PRs are blocked when contract/policy checks fail.
• Scheduled workflow emits actionable pin lifecycle output.
• Workflow behavior is documented for maintainers.

[linear]

INF-151