ci: staging branch with batched CI and Claude Code review [skip-regression-check]

Redesign CI to speed up PR feedback by deferring heavy tests to a
30-minute batch on the staging branch. PRs only run fmt + clippy +
regression-test-check. The batch CI runs tests, E2E, and a Claude
Code review with confidence-scored findings that gate promotion to
main.

- test.yml: replace PR/push triggers with workflow_call + dispatch
- e2e.yml: replace PR paths trigger with workflow_call
- coverage.yml: add workflow_call + dispatch triggers
- code_style.yml: absorb version-check job from test.yml
- staging-ci.yml: new orchestrator (30-min cron, change detection,
  tests + e2e + claude-review → gate → tag + promote-to-main)
- claude-review.yml: new reusable review workflow with 0-100
  confidence scoring (CRITICAL ≥80 blocks, ≥50 creates issues,
  <50 CRITICAL gets low-confidence label)
- create-labels.sh: add staging-ci-review, skip-claude-gate,
  low-confidence labels

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

.github/workflows/code_style.yml

@@ -44,15 +44,32 @@ jobs:
     - name: Check lints
       run: cargo clippy --all --benches --tests --examples ${{ matrix.flags }} -- -D warnings
 
+  version-check:
+    name: Version Bump Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Check version bumps for changed extensions
+        env:
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+        run: ./scripts/check-version-bumps.sh
+
   # Roll-up job for branch protection
   code-style:
     name: Code Style (fmt + clippy)
     runs-on: ubuntu-latest
     if: always()
-    needs: [format, clippy]
+    needs: [format, clippy, version-check]
     steps:
       - run: |
           if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" ]]; then
             echo "One or more jobs failed"
             exit 1
           fi
+          if [[ "${{ needs.version-check.result }}" == "failure" ]]; then
+            echo "Version bump check failed"
+            exit 1
+          fi