ci: add pairing-or-review gate

[vilasmaciel]

⛔ On hold — this thin-caller does not work here.
This repo is a public fork, and it cannot call the reusable workflow in the private cosmos-audiences repo (GitHub blocks public→private reusable-workflow calls). The run fails at startup and no pairing-or-review status is posted.

To apply the gate here it must be inlined (self-contained github-script, no external uses:) or the repo made private. Awaiting a decision — do not merge as-is.

---Adds the shared Pairing or Review gate to this repo — the same rule already active in cosmos-audiences, hubble-segmentation, ai-segment-naming, socialbro, etc.

What this does

A thin caller workflow that delegates to the reusable workflow in cosmos-audiences (.github/workflows/pairing-or-review-reusable.yml@main). On every PR it posts a pairing-or-review commit status that:

• passes automatically if every (non-merge) commit has a Co-Authored-By trailer from a real human other than the author (evidence of pairing);
• otherwise passes once a reviewer (≠ author) approves;
• a hotfix label skips the review gate (CI stays required).

Follow-up (not in this PR)

Once merged, a repository ruleset (main: pairing or review) will mark the pairing-or-review status as required and force PRs to the default branch, matching the other repos.

Note: the pairing-or-review check on this PR will report "needs review" because the commit isn't paired — that's the gate working as intended. It's non-blocking until the ruleset is added.

🤖 Generated with Claude Code