Enable auto-merge, gated on a dedicated CI passed check

[potiuk]

Enables GitHub auto-merge for PRs to main, as proposed in [PROPOSAL] Enable auto-merge for PRs to main.

How it works. A committer approves a PR and clicks Enable auto-merge (or gh pr merge --squash --auto); GitHub squash-merges it once it is approved, conversations are resolved and the required checks are green. A push by the PR author disables auto-merge, so the author cannot change the PR after approval.

What changes

• .asf.yaml: allow_auto_merge: true, plus a "Require CI on main" ruleset that requires two checks from GitHub Actions: CI passed and check-newsfragment-pr-number. The airflow-committers team can bypass it.
• A new CI passed job in ci-amd.yml (mirrored in ci-arm.yml, which must stay in sync). It always runs and fails if any other CI job failed or was cancelled. Jobs skipped by selective checks count as passed, so PRs that run only part of the tests still get a result.
• A check-ci-gate-needs prek hook (with tests) that fails if a CI job is missing from the gate's needs.
• check-newsfragment-pr-number now also runs on labeled/unlabeled, so adding the skip newsfragment check label clears a failed run instead of leaving a stale required failure.
• Committer docs in dev/README_AIRFLOW3_DEV.md.

Why it failed in 2025, and what's different now. Auto-merge was enabled as an experiment in #49746 and turned off a few days later (#50009, #50049).

• To stop auto-merge from merging before CI finished, "Finalize tests" became a required check. That removed the escape hatch: when CI was red for an unrelated reason, nobody could merge.
• It was also switched on without a dev@ discussion first.

Today, .asf.yaml rulesets support bypass_teams, so committers can still merge past an unrelated red check via bypass rules. That's the override the 2025 thread asked for (INFRA-26779). And this change goes through a lazy consensus first.

Why a new check rather than "Finalize tests". "Finalize tests" is skipped when tests fail, and GitHub counts a skipped required check as passed, so requiring it would let auto-merge merge red PRs. The dedicated gate always reports a real result.

What auto-merge does not wait for: CodeQL (its check names depend on the languages detected), and the path-filtered Dependency review and Registry tests. These are listed in the docs. A PR that edits .github/workflows/ runs its own copy of the gate, so the docs ask committers to review such changes before enabling auto-merge. The gate is a convenience, not a security boundary; the committer's review still is.

Note for AIP-120: fork-CI PRs don't run project CI, so they won't produce CI passed. The AIP-120 PRs need to account for that before they merge.

Tested: the gate hook (7 tests) and the hook itself on the real workflows; the CI workflows stay in sync; prek passes (except lychee, which needs Docker locally).

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines