ci: 引入分支保护配套工作流（path 过滤 → detect-changes，AI review 自动化） (#5)

## Summary / 概要

为了让 `main` 分支保护规则在所有 PR 上稳定生效，调整两个现有 i18n workflow 并新增两个 AI review 配套
workflow。

### 已配置的 main ruleset（ID 16298003）

- 只允许 squash merge，禁止 force push / 删除
- 必需 status check：`validate`、`translate`，require
`strict_required_status_checks_policy=true`（必须 rebase 最新）
- PR
rule：`required_approving_review_count=0`、`required_review_thread_resolution=true`、`dismiss_stale_reviews_on_push=true`
- `bypass_actors=[]`：管理员也不能绕过

### 本 PR 改动

1. **i18n-validate / i18n-translate**：移除 `on.pull_request.paths`，把过滤下移到
job 内 `detect-changes` step。路径不相关时跳过实际逻辑但 job 仍 success，避免 required
check 因 path 过滤缺失而卡死非 i18n PR。
2. **auto-request-copilot-review** (新增)：PR
opened/reopened/ready_for_review 时自动 `POST
/pulls/{n}/requested_reviewers` 加 Copilot 为 reviewer。
3. **wait-for-copilot-review** (新增)：PR
opened/reopened/synchronize/ready_for_review 时启动，轮询 reviews API 等待
`copilot-pull-request-reviewer[bot]` 在当前 head SHA 提交 review。超时 8 分钟则
fail。
- 选择 polling 而不是 `pull_request_review` 事件触发是因为：Copilot bot 触发的
`pull_request_review` 事件被 GitHub 视为 first-time contributor，workflow run
会卡在 `action_required` 状态需 maintainer 在 web UI 手动批准，无法自动化。

合并后会再 PATCH ruleset 16298003，把 `wait-for-copilot-review` 加入 required
status checks 作为强制门槛。

## Test plan

- [x] `i18n-validate` 在本 PR 上跑出 success（PR 仅触及
`.github/workflows/`，relevant=false，走 skip 分支）
- [x] `i18n-translate` 同上
- [x] `auto-request-copilot-review` 跑出 success，Copilot 被自动加为 reviewer
- [x] `wait-for-copilot-review` 在 polling 窗口内捕获到 Copilot review 并 pass
- [ ] 解决 Copilot 提的 conversations 后能 squash merge
- [ ] 合并后用 PATCH ruleset 把 `wait-for-copilot-review` 加入 required checks

.github/workflows/i18n-translate.yml

@@ -12,11 +12,6 @@ name: i18n Auto-Translate
 
 on:
   pull_request:
-    paths:
-      - "skills/**/SKILL.zh-CN.md"
-      - "skills/**/SKILL.md"
-      - "manifest.json"
-      - "categories.json"
   workflow_dispatch:
     inputs:
       target_locale:
@@ -49,11 +44,32 @@ jobs:
           token: ${{ secrets.DESIRECORE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
 
+      - name: Detect relevant changes
+        id: changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -e
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git fetch --no-tags --depth=1 origin "$BASE_SHA" 2>/dev/null || true
+          changed=$(git diff --name-only "${BASE_SHA}...${HEAD_SHA}" || true)
+          if echo "$changed" | grep -qE '^(skills/.+/SKILL(\.zh-CN)?\.md$|manifest\.json$|categories\.json$)'; then
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "relevant=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install uv
+        if: steps.changes.outputs.relevant == 'true'
         uses: astral-sh/setup-uv@v3
 
       - name: Check for stale translations
         id: precheck
+        if: steps.changes.outputs.relevant == 'true'
         run: |
           set +e
           uv run --quiet scripts/i18n/translate.py --check
@@ -66,7 +82,7 @@ jobs:
           exit 0
 
       - name: Translate stale locales
-        if: steps.precheck.outputs.stale == 'true'
+        if: steps.changes.outputs.relevant == 'true' && steps.precheck.outputs.stale == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -84,12 +100,12 @@ jobs:
           uv run --quiet scripts/i18n/translate.py "${ARGS[@]}"
 
       - name: Validate after translation
-        if: steps.precheck.outputs.stale == 'true'
+        if: steps.changes.outputs.relevant == 'true' && steps.precheck.outputs.stale == 'true'
         run: uv run --quiet scripts/i18n/validate-i18n.py
 
       - name: Detect changes
         id: diff
-        if: steps.precheck.outputs.stale == 'true'
+        if: steps.changes.outputs.relevant == 'true' && steps.precheck.outputs.stale == 'true'
         run: |
           if git diff --quiet; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
@@ -154,3 +170,7 @@ jobs:
               issue_number: context.issue.number,
               labels: ['i18n-translation-failed'],
             });
+
+      - name: Skip notice
+        if: steps.changes.outputs.relevant != 'true'
+        run: echo "No i18n-relevant changes; translation skipped."