ci: code-quality caller (advisory)

[LukasWodka]

Adds the org's reusable code-quality workflow as an advisory caller: ruff (Python), shellcheck, gitleaks, and house-rules run on every PR with soft-fail at its default (true) — findings land as diff annotations and in the job summary, and nothing blocks. Flipping the jobs to required checks once the backlog is clear is tracked separately in tracebloc/backend#1303.

Part of tracebloc/backend#1302

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only addition with read permissions and soft-fail defaults; no application or runtime behavior changes.

Overview
Adds .github/workflows/code-quality-caller.yml, a PR workflow that delegates to the org reusable tracebloc/.githubcode-quality.yml with python: true and shell: true so ruff, shellcheck, gitleaks, and house-rules run on opened/reopened/sync/ready PRs.

Uses concurrency (cancel-in-progress) to drop stacked duplicate runs on fast pushes, contents: read permissions, and leaves soft-fail at the reusable workflow default (comment notes flipping to false later when checks can be required).

^{Reviewed by Cursor Bugbot for commit cf6cd3e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#219 — release-train: develop -> staging · author: @LukasWodka · no reviewer assigned
• averaging-service#220 — ci: code-quality caller (advisory) · author: @LukasWodka · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1297 — feat(db): gate MSSQL-only ODBC driver per engine + add psycopg (#1164) · author: @saadqbal · no reviewer assigned
• backend#1298 — fix(guardrails): reuse existing dimensional anomaly monitor (#1160) · author: @saadqbal · no reviewer assigned
• backend#1299 — release-train: develop -> staging · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cf6cd3e. Configure here.}