chore: Add PR validation workflow

[stephanie-anderson]

Summary

• Adds a validate-pr.yml workflow to automatically validate non-maintainer PRs
• Checks that PRs reference a GitHub issue with prior discussion between the author and a maintainer
• Closes PRs that don't meet contribution guidelines (no issue reference, no maintainer discussion, or issue assigned to someone else)
• Enforces that all PRs start as drafts

Rollout of getsentry/sentry-python#4233 across all SDK repos.

Test plan

• Verify workflow file is valid YAML
• Confirm SDK_MAINTAINER_BOT_APP_ID var and SDK_MAINTAINER_BOT_PRIVATE_KEY secret are available to this repo
• Test with a non-maintainer PR that has no issue reference (should be closed)
• Test with a maintainer PR (should be skipped)

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[sentry]

Bug: The enforce-draft job incorrectly runs on valid PRs because the was-closed output from the preceding job is not set for valid code paths, causing the conditional check to always pass.
_{Severity: CRITICAL}

Suggested Fix

The validate-non-maintainer-pr job should be modified to explicitly set the was-closed output to 'false' in all execution paths where the PR is deemed valid and is not closed. This ensures the enforce-draft job's conditional logic will evaluate correctly and only trigger for PRs that were not closed.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/validate-pr.yml#L262-L265

Potential issue: The `validate-non-maintainer-pr` job only sets its `was-closed` output
when it closes an invalid PR. For valid PRs from either maintainers or contributors, the
job exits early without setting this output. The output defaults to an empty string,
causing the conditional check `needs.validate-non-maintainer-pr.outputs.was-closed !=
'true'` in the `enforce-draft` job to evaluate to true. Consequently, the
`enforce-draft` job incorrectly runs on all valid, non-draft PRs, converting them to
drafts and posting misleading violation comments, which breaks the intended workflow for
both maintainers and contributors.