ci: enroll version-bump-gate (catch required bumps at PR time)

[LukasWodka]

Summary

Enrolls the version-bump-gate (built in backend#1563 but never wired into any repo) so a develop PR that touches published files while the version is already released fails on the author's own diff — instead of surfacing days later as a refused prod hop (which just cost us cli + tracebloc-py-package on 2026-08-10).

The reusable is a rule-for-rule copy of the release train's version_preflight, so it can never disagree with the gate it front-runs.

• soft-fail: false — a real gate (red on violation). Override a false positive with the skip-version-gate label (audited).
• Scoped to pull_request → develop (staging/main promotion mirrors are handled by the train itself).

Part of a fleet enrollment across all 5 version-published repos (data-ingestors, tracebloc-py-package, cli, design-system, client).

---

Note

Low Risk
CI-only change with read-only permissions; no runtime or application code is modified.

Overview
Adds a version-bump-gate workflow that runs on pull requests to develop, calling the shared tracebloc/.github reusable gate so PRs that change client/* without bumping the version in client/Chart.yaml fail at review time instead of at prod promotion.

The caller sets soft-fail: false (blocking checks) and scopes enforcement to version-file: client/Chart.yaml and publish-paths: client/*. It also listens for labeled / unlabeled so applying or removing skip-version-gate re-runs the check.

^{Reviewed by Cursor Bugbot for commit 0dcc9d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9d96e18. Configure here.}

[LukasWodka]

Resolved the publish-path Bugbot thread: this caller copies publish-paths verbatim from release-train/repos.yml (parity — the gate must match the train's own version_preflight exactly; diverging would let the gate disagree with the train). The matcher is shell-case where * crosses /, so nested files are already covered. Any genuine publish-surface gap is a repos.yml/train question, tracked in https://github.com/tracebloc/backend/issues/1679.

[shujaatTracebloc]

Re-approving after the earlier approval was dismissed by a later push. Re-verified at current head: single-file caller for tracebloc/.github/version-bump-gate.yml@main, correctly parameterized for this repo (version-file client/Chart.yaml, publish client/*), permissions: contents: read, soft-fail: false, and the labeled/unlabeled trigger so the skip-version-gate override actually re-runs the gate. CI all-green, Bugbot clean, no unresolved threads. LGTM.