ci: replace path triggers with workflow_run cascade pipeline

[loadinglucian]

Summary

• Replace duplicated pull_request/push path filters with workflow_run event triggers, creating a sequential pipeline: Quality Gates → VM Tests → Cloud Tests (AWS + DO)
• Each stage verifies upstream job conclusions via actions/github-script before proceeding, skipping with a notice if prerequisites didn't succeed
• Add actions: read permission and explicit ref: head_sha checkout to ensure correct commit is tested under workflow_run context

Test plan

• Push a change that triggers quality gates and verify VM tests fire after all five pass
• Verify cloud tests (AWS, DO) fire only after VM tests succeed
• Confirm skipped stages emit a notice when upstream fails
• Verify concurrency groups correctly cancel superseded runs

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows are restructured to implement a gating system. Cloud test workflows now depend on VM test workflow completion, and the VM test workflow depends on quality check workflows. All workflows transition from direct PR/push triggers to workflow_run events with explicit ref pinning and gate verification jobs.

Changes

Cohort / File(s)	Summary
Cloud workflow gating .github/workflows/bats-cloud-aws.yml, .github/workflows/bats-cloud-do.yml	Replaced PR/push triggers with workflow_run for VM test completion. Added vm-gate job to verify "vm-tests (ubuntu24)" success before running cloud tests. Updated concurrency group and checkout step to use workflow_run head SHA. Extended permissions with actions: read.
VM workflow quality gates .github/workflows/bats-vm-ubuntu24.yml	Replaced PR/push triggers with workflow_run for quality workflows (Pest, PHPStan, Pint, Rector, CI Canary). Introduced quality-gate job to verify successful completion of all quality checks. Updated vm-tests job to depend on quality gates and pin checkout ref to workflow_run head SHA. Added actions: read permission.

Possibly related PRs

• ci: split cloud/VM workflows into provider-specific files #325: Modifies the same CI workflow files with complementary gating infrastructure changes for provider-specific workflow splitting.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: replacing path-based PR/push triggers with workflow_run cascade pipeline, which is the core transformation across all three modified workflow files.
Description check	✅ Passed	The description comprehensively covers the changeset: it explains the workflow restructuring from path filters to workflow_run triggers, the gating pattern with actions/github-script verification, and permission/checkout updates across all files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}