[actions] Extract shared Fast Forward workflows

[coisa]

Summary

Extract the shared Fast Forward reusable workflow and composite action implementation into the organization .github repository, with local self-check triggers, versionable remote composite-action references, and a reusable setup action that can resolve fast-forward/dev-tools from the consumer project or install it globally when needed.

Changes

• Add reusable workflow implementations for tests, reports, changelog, wiki, review, label sync, project automation, and predictable conflict resolution.
• Keep the migrated workflows callable via workflow_call and runnable inside this repository through their original local triggers.
• Add the composite action tree those workflows depend on, and call those actions through php-fast-forward/.github/.github/actions/...@ref instead of asking consumer workflows to pass a duplicate action checkout ref.
• Add release publication automation that pins internal shared-action refs to vX.Y.Z for .github releases before creating the GitHub release tag.
• Add .github/actions/dev-tools/setup to prefer vendor/bin/dev-tools, fall back to PATH, or install fast-forward/dev-tools globally with Composer plugin allowances and --no-scripts.
• Add composer.json for this repository with fast-forward/dev-tools as a development dependency so the shared workflows can use a project-local CLI here.
• Add .github/actions/php/detect-project and guard test/report jobs so repositories without Composer, PHPUnit configuration, docs, PHP source, or test files skip those jobs instead of failing.
• Let the Composer setup action skip dependency installation when a consumer repository has no composer.json.
• Update migrated workflow commands to call DEV_TOOLS_BIN directly instead of assuming composer dev-tools exists in the consumer project.
• Document the .github / dev-tools / consumer ownership split, versioned workflow refs, release ref pinning, and add an extraction inventory.

Testing

• composer validate --strict
• COMPOSER_ROOT_VERSION=dev-task/2-extract-shared-workflows composer install --dry-run --prefer-dist --no-progress --no-interaction --no-plugins --no-scripts
• actionlint
• git diff --check
• find .github/actions -name '*.sh' -print -exec bash -n {} \;
• find .github/actions -name '*.php' -print -exec php -l {} \;
• find .github/actions -name '*.cjs' -print -exec node --check {} \;
• dev-tools changelog:check --against=refs/remotes/origin/main
• Static grep confirms migrated workflows no longer reference repository: php-fast-forward/dev-tools, php-fast-forward/dev-tools/.github/workflows, composer dev-tools, .fast-forward-actions, or automation-ref.
• Project-surface smoke confirms this repository resolves to composer-json=true, docs-source=true, php-files=false, phpunit-config=false, test-files=false, testable=false, and reportable=false.
• Release pinning smoke on copied workflow files confirms internal shared-action refs are rewritten from the branch ref to @v0.1.0.
• Local setup smoke: action resolves a fake project-local vendor/bin/dev-tools without global install.
• Global setup smoke: action installs fast-forward/dev-tools:^1.0 into a temporary COMPOSER_HOME, configures the required Composer plugins, exposes DEV_TOOLS_BIN, and does not run dev-tools:sync scripts.
• GitHub Actions on this PR pass with expected skips for PHPUnit/report jobs in this automation-only repository.
• Consumer smoke in [smoke] Exercise shared workflow extraction agents#3 passes while providing only uses: php-fast-forward/.github/.github/workflows/*@task/2-extract-shared-workflows, with no duplicate action ref input.

Refs php-fast-forward/dev-tools#240
Refs php-fast-forward/dev-tools#238
Closes #2

[coisa]

Smoke test against php-fast-forward/agents completed successfully before merge.\n\n- Smoke PR: php-fast-forward/agents#3\n- Branch: smoke/shared-workflows-pr-3\n- Called workflows from: php-fast-forward/.github/.github/workflows/*@task/2-extract-shared-workflows\n- Passed: predictable conflicts, changelog validation, reports summary, tests summary, CodeQL.\n- Expected skips confirmed: PHPUnit tests/dependency health and report generation skipped because agents has no PHPUnit/reportable PHP surface yet.\n\nThis validates the reusable workflow branch plus automation-ref: task/2-extract-shared-workflows against a real consumer repository.

[coisa]

Smoke atualizado com o contrato sem automation-ref: php-fast-forward/agents#3 agora chama apenas os reusable workflows via uses: php-fast-forward/.github/.github/workflows/*@task/2-extract-shared-workflows.

Resultado: checks verdes no smoke, com os skips esperados para jobs que dependem de PHP source, PHPUnit config ou docs reportaveis nesse pacote inicial.