feat: gate agent pull requests on the public API delta

[jcant0n]

Extends the API gate to this repository, with auto-merge on an additive verdict — matching Vulkan.NET.

Only pull requests authored by the agent and carrying agent:binding-update are eligible, and needs-human-review on the pull request vetoes it. The agent can hold its own merge, never grant it.

This package ships no native libraries, so there is no header-to-binary coherence to check: the managed surface is the whole contract.

🤖 Generated with Claude Code

[github-actions]

API gate: additive

Every symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.

Target framework	Added	Removed
net10.0	+0	-0

_{Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal.}