fix(ci): make sdk check name mergify-safe

[XuPeng-SH]

Summary

Mergify could not queue approved PR #725 even though its GitHub Actions SDK check was green. The required check was named @astra/sdk (typecheck, test+coverage, build). Mergify reserves a leading @ for GitHub-App-qualified checks, so its injected branch-protection condition treated that check as an invalid/unmatched qualifier and left the PR waiting indefinitely.

Rename the workflow job to Astra SDK (typecheck, test+coverage, build), which remains a stable required check while avoiding the reserved syntax. Add a repository validator guard so the old name cannot return silently, and document the one-time branch-protection migration.

After this PR is merged and the new check has appeared once, update main branch protection: remove @astra/sdk (typecheck, test+coverage, build) and add Astra SDK (typecheck, test+coverage, build). Keep the old entry until the new check has completed once; removing it first would weaken the protection gate, while retaining it permanently would block every PR after the rename.

User impact

Approved PRs can enter the existing serial Mergify queue and be merged after the required checks pass. Queue policy, approval requirements, branch protection, and CI coverage remain unchanged. No runtime, API, storage, release, or credential changes are included.

Verification

• python3 -m unittest discover -s scripts/ci -p 'test_*.py' — 57 tests pass
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/static-checks.yml — pass
• repository validator with the pre-existing local macOS execution-lease contract excluded — pass
• git diff --check — pass

Related observation

The failure was reproduced on PR #725: Mergify's queue status showed only the SDK check condition unsatisfied, while the GitHub check and all other queue conditions were successful. This PR does not auto-close or modify #725.