Skip the pull request workflow for draft PRs

[MaxGhenis]

Summary

The PR workflow runs 35 jobs, about 570 runner-minutes per run, on every push to every open PR, drafts included. 36 of the 123 open PRs are drafts. Many PRs also get several pushes during review rounds before they are ready.

This PR makes draft PRs skip the workflow:

• Triggers. pull_request now lists types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]. Marking a PR ready for review starts a full run.
• Guard. The three root jobs (ReleaseLock, ReleaseLockTests, check-changelog) carry if: github.event.pull_request.draft == false. Every other job needs one of them, directly or transitively, so the whole run skips for drafts. No job uses always().
• Cancelling. Converting a PR back to draft starts a run whose jobs all skip. It shares the existing concurrency group (cancel-in-progress: true), so it cancels any run still in progress.

Branch protection is unaffected. Draft PRs can't merge, and a ready PR gets a full run.

Invariants (tested)

policyengine_us/tests/code_health/test_pr_workflow_skips_drafts.py:

• ready_for_review and converted_to_draft are among the triggers.
• Every job either is a guarded root, or needs only jobs that reach guarded roots.
• No job-level condition uses a status function that runs past a skipped need (always(), cancelled(), failure()). The !cancelled() mutation on Lint fails the test.

Both tests fail on main and pass here. The existing workflow tests also pass: .github/tests/test_release_build.py (8), test_make_test_matches_ci.py (2) and test_rest_python_groups.py (12).

Readiness caveat (review finding)

On a draft, gh pr checks exits 0 with every check skipped, and mergeable stays MERGEABLE. A readiness check that only reads those two can therefore pass on code that ran no CI. The same is true in the seconds after gh pr ready, before the new run registers.

Merge tooling should also require:

• isDraft == false;
• a latest Pull request run at the exact head that concluded success, not skipped.

The US + core hub's merge gate now requires both.

Live check

This PR is opened as a draft. A pull_request run uses the workflow file from the PR's merge commit, so this PR's own CI should skip every job while it is a draft. Main is currently red (#9992 fixes it), so it will be marked ready after #9992 lands, and that should start the full suite.

Impact

No model output change: only the CI workflow, a test and a changelog fragment change.

axiom: n/a

🤖 Generated with Claude Code