github PR gate (#4070)

## Description:

## Summary

Adds a GitHub Action that auto-closes PRs which don't follow the
contribution workflow, so maintainer review time goes to legitimate
contributions instead of off-roadmap or AI-generated submissions.

Triggered on `pull_request_target: [opened, reopened]` and **defaults to
dry-run** so it's safe to merge before flipping live.

## Gate logic (first match wins)

1. **Maintainer bypass** — PR carries `bypass-pr-check` label → pass.
2. **Org/repo member** — `author_association` is `OWNER` / `MEMBER` /
`COLLABORATOR` → pass.
3. **Approved work** — PR body links an issue (`Closes/Fixes/Resolves
#N`) that carries the `approved` label and the PR author is in the
issue's assignees → pass.
4. **Small fix** — `additions + deletions ≤ 50` → pass + apply
`small-fix` label.
5. **Otherwise** — apply `auto-closed-needs-issue` label, post rejection
comment, close.

## Please complete the following:

- [x] I have added screenshots for all UI updates
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [x] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

evan

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,4 +1,7 @@
-If this PR fixes an issue, link it below. If not, delete these two lines.
+> **Before opening a PR:** discuss new features on [Discord](https://discord.gg/K9zernJB5z) first, and file bugs or small improvements as [issues](https://github.com/openfrontio/OpenFrontIO/issues/new/choose). You must be assigned to an `approved` issue — unsolicited PRs will be auto-closed.
+
+**Add approved & assigned issue number here:**
+
 Resolves #(issue number)
 
 ## Description:
@@ -10,7 +13,6 @@ Describe the PR.
 - [ ] I have added screenshots for all UI updates
 - [ ] I process any text displayed to the user through translateText() and I've added it to the en.json file
 - [ ] I have added relevant tests to the test directory
-- [ ] I confirm I have thoroughly tested these changes and take full responsibility for any bugs introduced
 
 ## Please put your Discord username so you can be contacted if a bug or regression is found:
 

.github/workflows/pr-gate.yml

@@ -0,0 +1,36 @@
+name: 🚪 PR Gate
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: read
+
+jobs:
+  gate:
+    name: Evaluate gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout base
+        uses: actions/checkout@v6
+        with:
+          submodules: false
+          persist-credentials: false
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - name: Install gate deps
+        working-directory: scripts/pr-gate
+        run: npm install --no-audit --no-fund --ignore-scripts
+      - name: Run gate
+        working-directory: scripts/pr-gate
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          DRY_RUN: ${{ vars.PR_GATE_DRY_RUN || 'true' }}
+        run: npx tsx index.ts