feat(repo): gate external contributions

[cesarenaldi]

Summary

• document the approved-issue workflow for external contributors
• add a pull request template that links the approved issue
• automatically close unapproved fork PRs while bypassing same-repository and write-access contributors
• keep the privileged gate metadata-only and pin its action dependency by full commit SHA

Verification

• actionlint .github/workflows/external-contribution-gate.yml
• pnpm lint
• pnpm typecheck

Repository settings required before rollout

• create the contribution-approved label
• allow pull requests from external contributors
• limit users without write access to one concurrent open PR
• require approval before external fork workflows run
• keep fork workflow tokens read-only and do not expose secrets