[actions] Extract shared Fast Forward workflows

[coisa]

Summary

Extract the shared Fast Forward reusable workflow and composite action implementation into the organization .github repository, with local self-check triggers, explicit shared-action source checkouts, and a reusable setup action that can resolve fast-forward/dev-tools from the consumer project or install it globally when needed.

Changes

• Add reusable workflow implementations for tests, reports, changelog, wiki, review, label sync, project automation, and predictable conflict resolution.
• Keep the migrated workflows callable via workflow_call and runnable inside this repository through their original local triggers.
• Add the composite action tree those workflows depend on, then checkout php-fast-forward/.github into .fast-forward-actions before calling local action paths.
• Remove automation-ref and release-time default-branch writes; shared-action refs are resolved inside each reusable workflow.
• Resolve shared-action source from the current ref for local .github runs, from the base SHA for local pull_request_target, and from the latest stable .github release for consumer workflow_call runs with main fallback.
• Allow temporary consumer smoke tests through a repository variable named FAST_FORWARD_ACTIONS_REF, without adding another reusable workflow input.
• Add .github/actions/dev-tools/setup to prefer vendor/bin/dev-tools, fall back to PATH, or install fast-forward/dev-tools globally with Composer plugin allowances and --no-scripts.
• Add composer.json for this repository with fast-forward/dev-tools as a development dependency so the shared workflows can use a project-local CLI here.
• Add .github/actions/php/detect-project and guard test/report jobs so repositories without Composer, PHPUnit configuration, docs, PHP source, or test files skip those jobs instead of failing.
• Let the Composer setup action skip dependency installation when a consumer repository has no composer.json.
• Update migrated workflow commands to call DEV_TOOLS_BIN directly instead of assuming composer dev-tools exists in the consumer project.
• Document the .github / dev-tools / consumer ownership split, shared-action source ref resolution, and the extraction inventory.

Testing

• composer validate --strict
• COMPOSER_ROOT_VERSION=dev-task/2-extract-shared-workflows composer install --dry-run --prefer-dist --no-progress --no-interaction --no-plugins --no-scripts
• actionlint
• git diff --check
• find .github/actions -name '*.sh' -print -exec bash -n {} \;
• find .github/actions -name '*.php' -print -exec php -l {} \;
• find .github/actions -name '*.cjs' -print -exec node --check {} \;
• dev-tools changelog:check --against=refs/remotes/origin/main
• Static grep confirms migrated workflows no longer reference repository: php-fast-forward/dev-tools, php-fast-forward/dev-tools/.github/workflows, composer dev-tools, automation-ref, or direct default-branch pinning pushes.
• Project-surface smoke confirms this repository resolves to composer-json=true, docs-source=true, php-files=false, phpunit-config=false, testable=false, and reportable=false.
• Local setup smoke: action resolves a fake project-local vendor/bin/dev-tools without global install.
• Global setup smoke: action installs fast-forward/dev-tools:^1.0 into a temporary COMPOSER_HOME, configures the required Composer plugins, exposes DEV_TOOLS_BIN, and does not run dev-tools:sync scripts.
• GitHub Actions on this PR are expected to pass with skips for PHPUnit/report jobs in this automation-only repository.
• Consumer smoke can be run from php-fast-forward/agents by setting repository variable FAST_FORWARD_ACTIONS_REF=task/2-extract-shared-workflows while this PR is not released yet.

Refs php-fast-forward/dev-tools#240
Refs php-fast-forward/dev-tools#238
Closes #2

[coisa]

Smoke test against php-fast-forward/agents completed successfully before merge.\n\n- Smoke PR: php-fast-forward/agents#3\n- Branch: smoke/shared-workflows-pr-3\n- Called workflows from: php-fast-forward/.github/.github/workflows/*@task/2-extract-shared-workflows\n- Passed: predictable conflicts, changelog validation, reports summary, tests summary, CodeQL.\n- Expected skips confirmed: PHPUnit tests/dependency health and report generation skipped because agents has no PHPUnit/reportable PHP surface yet.\n\nThis validates the reusable workflow branch plus automation-ref: task/2-extract-shared-workflows against a real consumer repository.

[coisa]

I updated the design to prevent any direct pushes to the protected branch.

Now each reusable workflow explicitly checks php-fast-forward/.github in .fast-forward-actions before calling local actions. The action ref is resolved as follows:

• .github repository: current ref; in pull_request_target, based on SHA
• consumers via workflow_call: latest stable release from .github, with fallback to main
• temporary smoke: repository variable FAST_FORWARD_ACTIONS_REF in the consumer

I validated in the .github PR and re-ran the smoke in php-fast-forward/agents#3 using FAST_FORWARD_ACTIONS_REF=task/2-extract-shared-workflows; both turned green. The temporary variable from agents has already been removed.