Per-PR reverse-dependency gate against downstream codes

[krystophny]

Replaces the release-branch gate with a per-PR reverse-dependency gate.

On every libneo PR, dispatch each downstream's CI to build and fast-test against this PR's libneo commit (-f libneo_ref=<sha>), and gate the PR on green. This keeps libneo main continuously working with the downstream codes, and attributes any break to the PR that caused it.

• .github/workflows/downstream-gate.yml: runs on pull_request (same-repo, non-draft). Dispatches, polls, and gates on each downstream's run. blocking=no rows are dispatched and reported as a warning but never fail the gate.
• ci/downstreams: the gated set, with blocking and full columns. NEO-RT is report-only (transitive through NEO-2; its own build does not yet compile the candidate libneo). NEO-2 is full=no: it splits its CI, so the gate triggers only its fast unit-tests.yml and its slow suite stays on NEO-2 PRs.

The dispatched runs use each downstream's fast tests. Label the libneo PR full-ci to also dispatch the slow suite (golden records, performance, PAR) of each downstream whose full column is yes, with -f full=true.

Required secret

The gate authenticates as secrets.RELEASE_BOT_TOKEN. The repo or org must define this secret as a fine-grained PAT or GitHub App installation token scoped to the six downstream repositories — itpplasma/SIMPLE, itpplasma/NEO-2, itpplasma/MEPHIT, itpplasma/KAMEL, itpplasma/NEO-RT, itpplasma/rabe — with these repository permissions:

• Actions: read and write (dispatch workflow_dispatch and read the resulting runs)
• Contents: read
• Metadata: read

The default GITHUB_TOKEN cannot dispatch workflows in other repositories, so this dedicated token is mandatory.

Per-downstream dispatch workflows must land first

The gate dispatches each downstream's workflow on its default branch, so the workflow_dispatch trigger (with the libneo_ref, and where full=yes the full, input) must already be merged to that downstream's default branch before this gate can dispatch it. Merge each downstream's CI-wiring PR before merging this one:

Downstream	Workflow	Dispatch PR
SIMPLE	main.yml	merged on main
NEO-2	unit-tests.yml	itpplasma/NEO-2#87
MEPHIT	main.yml	itpplasma/MEPHIT#19
KAMEL	ci.yml	itpplasma/KAMEL#132
NEO-RT	test.yml	merged on main
rabe	test.yml	itpplasma/rabe#83

Until a downstream's PR lands, its gate step fails to dispatch (for a blocking=yes row that turns the libneo PR red).

Closes #293

[krystophny]

Merge order: merge itpplasma/NEO-2#87 first, then this PR. The gate dispatches NEO-2's unit-tests.yml on its default branch, so that workflow must be on NEO-2 main first; otherwise the NEO-2 gate step fails to dispatch and goes red.

[krystophny]

Made the gate per-downstream so each code keeps its own CI convention; no downstream is forced into one shape.

What changed:

• ci/downstreams full column is no longer a boolean. Values: no (fast-only), yes (re-dispatch the row's workflow with -f full=true, the self-escalating shape SIMPLE/MEPHIT/KAMEL use), or a comma-list of extra workflows to dispatch on full-ci.
• downstream-gate.yml: factored dispatch+watch into run_wf and run the resolved set per row. Fast tier always dispatches the row's workflow with -f libneo_ref=<sha>; on full-ci it self-escalates (yes) or also dispatches the listed workflows.
• rabe is full=golden.yml: it keeps its slow suite in its own golden.yml rather than a full tier in test.yml. golden.yml now accepts libneo_ref (itpplasma/rabe#83) so the gate builds it against the candidate. benchmark.yml is a rabe-commit perf trend, so it stays on rabe PRs, not the gate.

Modularity: ci/downstreams is the single source. Adding a downstream is one appended row; the workflow file needs no edit. The chosen workflow must accept a libneo_ref input.

Dispatch dry-run against the manifest (run_wf stubbed):

• fast: each row -> its workflow.
• full-ci: SIMPLE/MEPHIT/KAMEL -> their workflow + full=true; NEO-2/NEO-RT fast-only; rabe -> test.yml + golden.yml.