chore(ci): add stage pipeline, pin pip/uv/deps, issue forms and make pr

[gmmcosta15]

Description

• Feature
• Bug Fix
• Code Refactor
• Documentation

Summary

Adds a stage channel signed off on staging printers, makes CI reproducible (pinned runners, actions and dependencies), and adds contributor tooling (make pr, issue forms, PR template, labels).

Changes

• Stage channel: stage-signoff.yml records a staging deployment that the release rulesets require; stage-ci.yml and release-please removed.
• CI: dev-ci, CodeQL and title lint run on ubuntu-24.04 (26.04 has no Python 3.11.2), actions pinned by SHA, no paths filters (they left required checks pending forever), push runs on dev so stage has checks for the merged SHA, PRs into every base branch run CI, CodeQL also scans workflows and pushes to Release* branches.
• Pins: requirements.txt is the full aarch64 closure, exact pins only (requests, pillow, urllib3 added; typing dropped, it only ships a py2 wheel and broke every self-heal reinstall). requirements-dev.txt is fully pinned too, pip 26.2.1 is pinned in requirements-pip.txt for CI and BlocksScreen's own venv only (component venvs keep --upgrade pip), and uv is pinned to 0.12.24. CI checks that every pin has a bookworm aarch64 wheel and that the file pins every package pip resolves.
• Fleet: install scripts warn on pip failures instead of || true; post-merge and the updater hook re-run install when only the pip pin changes; bs-bootstrap uninstalls the stale typing backport on the next start (pip install -r never removes a dropped pin).
• Repo: issue forms + config, PR template moved to .github/ (the subfolder never auto-filled), Dependabot for actions only (targets dev, 7-day cooldown), label-based release notes.
• Tooling: make pr (title, labels, reviewers, local gates, review before push), make check runs all five CI gates, pyproject.toml reads deps from the requirements files. make diagnose and the scripts/healthcheck/ ignore entry are removed: that suite is bench-only and not in the repo, so the target failed on every clone.
• Stage sign-off: notify job emails the Hardware team a printable A4 test sheet of every change on each stage push (Power Automate + Outlook, repo secret HW_TEAMS_WEBHOOK, skipped with a warning while unset); merge commits and Dependabot bumps are left out, and a push with nothing else sends no email; a newer push cancels only the older sign-off.

Reviewer notes

• Merge before 2026-10-19: ubuntu-latest moves to 26.04 and the current dev CI loses Python 3.11.2.
• After merge: make lint-pr-title a required check on Development. Once stage carries this workflow, require the 5 ci-checks contexts on the Stage ruleset.
• Promotion: git fetch origin && git push origin origin/dev:stage (fast-forward only, never local dev), then a merge PR from stage into the release branch once the staging sign-off is approved. That promotion makes every box reinstall dependencies once; the next BlocksScreen start removes the stale typing.
• Staging printer run of the dependency change against 26305a1 (logs attached): the install plan for the new pins is empty, the bs-bootstrap cleanup removed typing 3.7.4.3, and pip check and imports pass afterwards. The traceback in the apply log is the check script's own import name, fixed for the dry rerun.
  bs_typing_dryrun-apply-20261013T144142.log
bs_typing_dryrun-dry-20261013T151019.log
• Dependabot, the PR template and issue forms are read from the default branch only, so they take effect once they reach it. make pr already uses the new template and base.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.