ci: trusted chain for DASH license check with fork gate

[umaucher]

Implements the first slice of phase 2 of the CI concept (#420): the DASH license check moves to the trusted chain. Doc clarifications (trigger matrix, secrets inventory) are handled in #420.

Changes

• license_check.yml (which used the banned pull_request_target trigger for forks) is replaced by:
  • license_check_core.yml: reusable DASH check core with explicit head-SHA checkout for the fork path
  • trusted_chain_gate.yml: reusable approved-for-ci fork gate — label must be present and no synchronize/head_ref_force_pushed timeline event after it (any push invalidates); rejects skip with an explanatory PR comment instead of failing
  • license_check_forks.yml: thin workflow_run listener wiring gate + core for fork PRs only
• on-pr.yml calls the core directly for repository PRs, merge_group and push (ADR 0001: two entry points, one core)

Notes for reviewers

• No branch-protection changes in this PR; required-check promotion happens later per the promotion ladder.
• Repo setting needed: restrict the approved-for-ci label to codeowners.
• All action refs pinned to full SHAs; latest versions verified (checkout v7.0.1, setup-bazel 0.19.0, create-or-update-comment v5.0.0, bazelisk 1.29.0).
• Non-fork PRs (including this one) will exercise the new direct license-check path immediately.

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: 47913079-ed39-4e36-9c3f-42ff47cd13c7
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Loading: 
Loading: 3 packages loaded
Loading: 3 packages loaded
    currently loading: 
Analyzing: target //:license-check (4 packages loaded, 0 targets configured)
Analyzing: target //:license-check (4 packages loaded, 0 targets configured)

Analyzing: target //:license-check (75 packages loaded, 10 targets configured)

Analyzing: target //:license-check (91 packages loaded, 10 targets configured)

Analyzing: target //:license-check (143 packages loaded, 623 targets configured)

Analyzing: target //:license-check (150 packages loaded, 3134 targets configured)

Analyzing: target //:license-check (150 packages loaded, 3134 targets configured)

Analyzing: target //:license-check (150 packages loaded, 3134 targets configured)

Analyzing: target //:license-check (160 packages loaded, 6342 targets configured)

Analyzing: target //:license-check (167 packages loaded, 9347 targets configured)

Analyzing: target //:license-check (173 packages loaded, 9397 targets configured)

Analyzing: target //:license-check (173 packages loaded, 9399 targets configured)

Analyzing: target //:license-check (176 packages loaded, 11287 targets configured)

Analyzing: target //:license-check (176 packages loaded, 11287 targets configured)

Analyzing: target //:license-check (176 packages loaded, 11287 targets configured)

Analyzing: target //:license-check (176 packages loaded, 11287 targets configured)

Analyzing: target //:license-check (176 packages loaded, 11287 targets configured)

Analyzing: target //:license-check (177 packages loaded, 11411 targets configured)

INFO: Analyzed target //:license-check (178 packages loaded, 11537 targets configured).
[13 / 17] JavaToolchainCompileClasses external/rules_java+/toolchains/platformclasspath_classes; 0s disk-cache, processwrapper-sandbox
INFO: From Generating Dash formatted dependency file ...:
INFO: Successfully converted 66 packages from Cargo.lock to bazel-out/k8-fastbuild/bin/formatted.txt
[15 / 17] JavaToolchainCompileBootClasspath external/rules_java+/toolchains/platformclasspath.jar; 0s disk-cache, processwrapper-sandbox
[16 / 17] Building license.check.license_check.jar (); 0s disk-cache, multiplex-worker
INFO: Found 1 target...
Target //:license.check.license_check up-to-date:
  bazel-bin/license.check.license_check
  bazel-bin/license.check.license_check.jar
INFO: Elapsed time: 37.197s, Critical Path: 2.45s
INFO: 17 processes: 12 internal, 4 processwrapper-sandbox, 1 worker.
INFO: Build completed successfully, 17 total actions
INFO: Running command line: bazel-bin/license.check.license_check ./formatted.txt <args omitted>
usage: org.eclipse.dash.licenses.cli.Main [-batch <int>] [-cd <url>]
       [-confidence <int>] [-ef <url>] [-excludeSources <sources>] [-help] [-lic
       <url>] [-project <shortname>] [-repo <url>] [-review] [-summary <file>]
       [-timeout <seconds>] [-token <token>]

[umaucher]

Superseded by #423 (same commits, recreated from a repository branch so the new direct license-check path is exercised by the PR itself).