ci: add hotfix cherry-pick provenance check

[laipz8200]

Summary

• Adds a GitHub Actions workflow for PRs targeting hotfix/** and lts/**.
• Adds a checker loaded from origin/main that requires each PR commit to include git cherry-pick -x provenance and verifies the source commit is reachable from main.
• Emits an English remediation message telling contributors to use git cherry-pick -x from main.

Screenshots

N/A