ci: gate prs on approved linked issues

[hashiiiii]

Summary

Add a pr-issue-gate workflow: PRs without an approved linked issue get an issue-first guidance comment from unidog-bot and are converted to draft.

Motivation

PrefabLens is pre-1.0; CONTRIBUTING (#54) states the issue-first policy, and this workflow enforces it reactively — PR creation itself cannot be blocked on GitHub. Gate passes when a Closes #NNN-linked issue in this repository (or the PR itself, as a maintainer escape hatch) carries the approved label. The owner, renovate[bot], and unidog-bot[bot] are exempt.

Merge after #54 — the bot comment links to CONTRIBUTING.md on main, which #54 introduces.

Changes

• .github/workflows/pr-issue-gate.yml: pull_request_target (opened/reopened/ready_for_review/edited), no PR code checkout, unidog-bot App token for all API calls; sticky marker comment (bot-authored only) + convertPullRequestToDraft; per-PR concurrency group; cross-repo Closes links are ignored (a contributor could self-apply approved in a repo they own); workflow_dispatch entry for E2E testing (OWNER PRs are exempt from the real trigger).
• Created the approved label (repo settings, not in this diff).

Testing

• ruby -ryaml parses the workflow; extracted run script passes bash -n.
• jq gate predicate verified against fixtures: same-repo approved issue → true; cross-repo approved issue → false; empty references → false.
• E2E after merge (workflow runs from the default branch): scratch PR without a linked issue → dispatch → expect bot comment + draft conversion; then approved on a linked scratch issue → dispatch → expect pass. Results will be posted in this PR.
• Known risk: convertPullRequestToDraft may fail for App tokens (Change of DRAF state of Pull Request not possible over graphql actions/toolkit#1165 documents it for GITHUB_TOKEN). The E2E run settles it; fallback is a classic PAT for the draft call only.