ci: adopt pr-claim, so PRs here are checked against a live Front Desk claim

.github/workflows/pr-claim.yml

@@ -0,0 +1,56 @@
+name: pr-claim
+
+# THE CANONICAL pr-claim CALLER, rolled to every non-archived org repo by
+# docs/handoffs/scripts/reroll-pr-claim.sh. Identical bytes in every repo —
+# nothing per-repo to substitute, which is what makes the roll safe to re-run.
+#
+# WHAT IT CHECKS. That this PR names an issue which is OPEN and still carries a
+# claim — via `Closes #N`, or `Claim-issue: owner/repo#N` on its own line for
+# work that runs under a claim without closing it. `.github-private`#723.
+#
+# WHY EVERY REPO NEEDS THIS FILE BEFORE THE RULESET REQUIRES THE CHECK.
+# A required status check with no workflow producing it never reports. It sits
+# pending forever and every PR in that repo becomes unmergeable. So the order is
+# not a preference:
+#
+#   1. roll this caller to every repo   (this lane)
+#   2. THEN add `pr-claim / pr-claim` to the org ruleset
+#
+# Reversing it bricks the org. Measured on 2026-08-29: `site`#260 opened and
+# merged at 03:09→03:17 with 19 checks and no `pr-claim` among them, and `site`
+# carries no caller — so the check cannot currently be required there.
+#
+# THE PERMISSIONS ARE GRANTED HERE, NOT IN THE REUSABLE. A `workflow_call`
+# callee can only ever NARROW what the caller hands it. A caller that omits
+# `issues: read` leaves the check unable to read a private issue — which it
+# reports as `unreadable` and counts as NOT claimed, the fail-closed direction,
+# but a false red rather than a true one.
+#
+# WHY THE PIN IS 8a56f22. That is `.github`#283, the newest commit to touch
+# `_pr-claim.yml`: it names which state each candidate issue is in rather than
+# collapsing four outcomes into one sentence. Pinning an older commit rolls a
+# check whose failure message cannot tell an unreadable issue from an unclaimed
+# one. The roll script refuses any template not pinned here.
+#
+# IT DOES NOT AUTHENTICATE THE CLAIMANT. A green `pr-claim` means "an open,
+# claimed issue was named", and no more — an author can name any claimed issue,
+# including someone else's. Closing that needs an authenticated guest identity
+# (`.github-private`#530), not more workflow plumbing. Do not cite this check as
+# authorization.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  pr-claim:
+    # Reading a PR and an issue. The reusable can only narrow what it is handed,
+    # so the grant is made here — see the note above on what omitting it costs.
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+    # SHA-pinned, per org policy — never a branch.
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@8a56f22f32bd007affbef503a4f1ac736c9aa52d