ci(#1420): add the fr-gate caller so .github can join the train

[LukasWodka]

Part of #1420 (D1 enrolment) and unblocks the .github half of #1276.

.github is joining the release train, and the train waits on gate / gate before a staging → prod hop. This repo had no fr-gate caller at all, so no such check existed to wait on — which is exactly why #1276 correctly refused to make gate / gate required here.

Open question 3, answered

Pinned @main, like every other caller. The decision is branch promotion, one standard process for every repo — a second promotion model for one repo is how drift starts, and the drift is more expensive than the blast radius it would avoid.

That makes the 118 tracebloc/*@main callers an accepted risk of record rather than an open item, and it means repo-inventory.yml's pinned_ref: main stays correct as written — no schema change needed. (Had the answer gone the other way, caller-drift.py:580 compares that value with !=, so every correctly-pinned caller would have become drift.)

The consequence, named rather than discovered

This repo hosts the reusable, so a change to fr-gate.yml on develop is not gating its own PR — main's version runs. .github cannot self-test a gate change before promoting it.

That is why the develop → staging → main path matters more here than anywhere else: staging is the only place a new gate runs against real board state before sixteen repos start consuming it at @main. Previously .github went develop → main with no intermediate, so a gate change reached the whole fleet on its first successful run.

Also in this PR's scope, already done outside it

step	state
staging branch created	✅ from main @ ee105cea, so staging's ancestry already contains prod's — no reconciliation needed on the first hop
staging protected	✅ 1 review, dismiss-stale, actionlint required, conversation resolution, no force-push
promotion-branches-merge-commit-only ruleset	✅ created; main + staging merge-only, develop untouched
back-merge check	✅ not needed — the 3 commits main has that develop lacks are all previous promotion merges (#120, #124, #127) and the file diff between them is empty, so no real change would be dropped

Still blocked on an owner action: the tracebloc-release-train App is not installed on .github. I verified it the reliable way — adding it to bypass_pull_request_allowances returns 200 OK and silently drops the value. Until it is installed, enrolling .github in repos.yml would create promotion PRs the train cannot merge.

branches: deliberately omits master: this repo has never had one, and listing a branch that does not exist is how the dead filters in #1428 accumulated.

---

Note

Low Risk
CI-only addition wiring an existing reusable workflow; no application, auth, or data-path changes.

Overview
Adds .github/workflows/fr-gate-caller.yml so this repo runs the shared FR gate on pull requests targeting staging and main, matching other repos on the release train and enabling a gate / gate status check to be required before promotion.

The caller delegates to tracebloc/.github/.github/workflows/fr-gate.yml@main with secrets: inherit, pinned at @main like fleet callers. Inline comments document the self-host caveat (PRs that change the reusable still run main’s gate) and that master is omitted from branches: because this repo has no such branch.

^{Reviewed by Cursor Bugbot for commit aa25769. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c86c462. Configure here.}