ci: add required-check migration tooling and cutover guide

[rwgk]

Description

Related to #2652. Depends on #2993's documentation link workflow and #2994's
standalone pre-commit workflow.

Add a read-only-by-default CLI to preview replacing the pre-commit.ci - pr
required check with the GitHub Actions checks Pre-commit (Linux),
Pre-commit (Windows), and Documentation links. Preserve unrelated rules,
required checks, enforcement, branch conditions, and bypass actors. Reject
inherited organization rulesets and unexpected App integration IDs.

Writing requires --apply, workflows merged into main, successful
representative checks bound to the expected App, and successful owning workflow
runs. Re-read affected rulesets immediately before writing and reject changes
made since discovery. Add mocked tests and preview/cutover/validation
instructions to the existing workflow guide.

The helper, tests, and cutover instructions were extracted unchanged from
#2993 so reviewers can assess repository-setting writes separately from the
workflow runtime. Merging this PR does not execute the helper or change live
required checks or App access. The existing service stays active; applying the
cutover requires separate authorization.

Validation through PATH Pixi with Python 3.14: all 123 standalone CI-tool tests
and 36 subtests pass, including the migration helper and link-input tests.
Repository pre-commit checks pass with the workflow's existing lychee and
local hook-installation reminder skips. The migration helper and its tests
are byte-identical to the pre-split implementation.

Hosted validation on 7e1a772a413f34e7031ca5382f6bd80940cdd39b: the
pre-commit workflow
passes on Linux and Windows, and the
documentation workflow
passes authored links, rendered HTML, and the aggregate gate.

This PR stays draft. Heavyweight CI remains under /ok to test <full-SHA>
control.

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.