Require user journey tests for behavior changes

[rohita5l]

Summary

• add a trusted LLM-backed CI gate that detects new or materially changed ug user journeys and requires meaningful tests/integration coverage
• judge bounded product/test diffs using the existing UCODE_TEST_WORKSPACE and DATABRICKS_BEARER secrets plus the trusted tests/AGENTS.md policy
• fail closed with a direct CTA to add a complete user-journey test
• allow only @rohita5l or @lilly-luo to bypass with the exact /skip-user-journey-test comment, mirrored to a visible PR label

Security

• run the gate from the trusted default branch with pull_request_target
• never check out or execute PR-head code
• treat titles and patches as untrusted text and cap the submitted diff
• reject malformed judge responses and gateway failures unless an authorized waiver exists

Testing

• uv run pytest tests/test_user_journey_gate.py -q (8 passed)
• Ruff check passed
• Ruff format check passed
• both workflow YAML files parse successfully
• git diff --check passed

Required repository setup

• set UG_CI_USER_JOURNEY_JUDGE_MODEL to a chat-capable system.ai model
• add User Journey Test Required as a required branch-protection check after this merges

[bbqiu]

LGTM! you all can refine the workflow as time goes on