ci: enforce semantic PR workflow policy

[albert20260301]

Summary

• sync the semantic pull-request workflow to the shared policy
• pin the runner to Ubuntu 24.04 and the semantic-title action to its reviewed commit
• apply least-privilege permissions, bounded runtime, and per-PR concurrency

Validation

• git diff --check
• exact byte comparison with the canonical semantic-workflow template
• bash scripts/validate-workflow-policy.sh . still reports the existing ci.yml runner policy drift; that unrelated workflow is intentionally out of scope for this focused PR

Impact

This changes only pull-request title validation infrastructure. It does not change the SDK API or release artifacts.

[albert20260301]

@leo-altertable could you review this?

I picked you because the Python stack is the closest ownership signal available for this repository. CI is pending. The main review focus is whether the workflow preserves pull-request title validation while applying the shared runner, action-pin, permission, timeout, and concurrency policy.

[albert20260301]

@leo-altertable could you take a look when you have capacity? This remains a focused semantic-workflow policy change, and the lint/typecheck plus Python 3.9–3.14 test matrix are green. The key review point is preserving pull-request title validation while applying the shared workflow policy.

[albert20260301]

@leo-altertable could you review this?

This semantic-workflow-only change remains green and has been awaiting review since the prior request on August 7. The main focus is preserving Release Please's squash-title validation behavior.

[albert20260301]

@leo-altertable: this semantic-workflow change remains green and has had no reviewer activity since the August 10 follow-up. Could you review it when you have capacity?

[albert20260301]

@leo-altertable could you review this when you have capacity?

The semantic-workflow change remains green after more than three days without reviewer activity. The review focus is preserving the release-title gate while keeping the shared workflow policy compliant.

[albert20260301]

@leo-altertable could you review this when you have capacity?

This scoped change is still green and has had no reviewer activity for at least three days. The review focus is preserving the Release Please title gate while keeping the shared workflow policy compliant..

[albert20260301]

@leo-altertable follow-up: this is still green and unreviewed after three days. Could you review that the Release Please title gate remains correct and the shared workflow policy is compliant?