Add CLA Assistant retry workflow

[clockwork-labs-bot]

Summary

• Add a small Retry CLA Assistant workflow for cases where license/cla is missing or pending after the normal PR checks have gone green.
• Keep the workflow thin: it checks out trusted default-branch code, determines the PR number from the GitHub event, and runs cargo ci retry-cla-assistant --pr-number <number>.
• Put the retry gate and CLA Assistant recheck call in the existing Rust tools/ci crate.
• Trigger it from PR updates, any workflow completion, manual dispatch with a PR number, and a 15-minute scheduled fallback sweep.

Behavior

The workflow passes explicit PR numbers into the Rust command. For scheduled runs, it enumerates open master PRs in the workflow and invokes the Rust command for each one.

The cargo ci retry-cla-assistant --pr-number <number> command only calls CLA Assistant's recheck endpoint when the PR is open, non-draft, targets master, the head SHA is at least 10 minutes old, at least one check run exists, all reported check runs are green, no non-CLA commit status is non-green, and license/cla is missing/pending/failing.

The workflow_run trigger is intentionally unfiltered, so adding or renaming CI workflows does not require changing this workflow.

It calls https://cla-assistant.io/check/{owner}/{repo}?pullRequest={number} and polls license/cla for up to 3 minutes.

Safety

• The workflow uses pull_request_target, but it does not check out or execute PR code. It checks out the trusted default branch before running the CI tool.
• It ignores completion of the Retry CLA Assistant workflow itself.
• It intentionally does not forge a license/cla status.

Validation

• Parsed the workflow YAML locally with Ruby/Psych.
• Ran cargo fmt --package ci.
• Ran cargo check -p ci.
• Ran cargo ci retry-cla-assistant --help and verified --pr-number is required.
• Tested the first Rust version against live PR Ungate procedures from the unstable feature #5164 metadata and caught that a hard-coded required-check list was too strict; replaced that list with a reported-checks-all-green gate.

Addresses #5215.

[bfops]

LGTM