[CLOV-1618] Add reusable workflow for Backpack adoption guard

[Richard-Shen (RichardSyq)]

Summary

• Adds .github/workflows/backpack-adoption-guard.yml as a reusable workflow (workflow_call) that wraps checkout + the guard action + Cortex upload.
• PR runs only compute the rate; Cortex upload is gated on github.event_name == 'push' && github.ref_name == github.event.repository.default_branch.
• Promotes the reusable workflow as the recommended setup in the README; demotes direct action invocation to a "Manual setup (advanced)" section that retains the manual Cortex upload pattern.

Consumers go from ~26 lines of bespoke YAML (current carhire-homepage form) to:

jobs:
  backpack-adoption-guard:
    uses: Skyscanner/backpack/.github/workflows/backpack-adoption-guard.yml@backpack-adoption-guard/v1
    with:
      cortex-entity: <your-entity>
    secrets:
      CORTEX_WEBHOOK_UUID: ${{ secrets.BACKPACK_ADOPTION_CORTEX_WEBHOOK_UUID }}

Why a separate PR

This is stacked on top of #4665 because the reusable workflow internally references Skyscanner/backpack/packages/backpack-adoption-guard@backpack-adoption-guard/v1 — that tag only exists once #4665 merges and the release workflow is run.

Recommended landing order:

1. Merge [CLOV-1618] Add Backpack adoption guard action #4665.
2. Run Backpack Adoption Guard Release with version=1.0.0 to create backpack-adoption-guard/v1.0.0 and backpack-adoption-guard/v1.
3. Optional: smoke test by pointing a consumer (e.g. carhire-homepage PR #5464) at @backpack-adoption-guard/v1 directly to confirm v1 works end-to-end.
4. Rebase this branch onto main, merge, then bump v1.1.0 so consumers can opt into the reusable form.
5. Update consumer (carhire-homepage) to call the reusable workflow.

Design notes

• dry-run default is true in the reusable workflow (vs false on the underlying action). Reusable workflow is consumer-facing and should be safe by default; consumers opt into enforcement explicitly. The README documents this deliberate divergence.
• CORTEX_WEBHOOK_UUID is required even though PR runs don't consume it. This is intentional — it forces consumers to wire up Cortex up front, avoiding "half-installed" states. workflow_call resolves the secret eagerly regardless of whether the upload step runs.
• Default branch detection uses github.event.repository.default_branch, so this works for repos using main, master, or anything else.
• runs-on is exposed as an input with default ubuntu-latest. Skyscanner repos that prefer ubuntu-latest-small can override.
• Permissions are {} at workflow level and contents: read at job level — the action itself only needs to read source.

Test plan

• PR CI passes (YAML linting, no executable changes).
• After [CLOV-1618] Add Backpack adoption guard action #4665 merges and v1 is tagged, smoke test by calling this reusable workflow from carhire-homepage on a dummy PR.
• Verify Cortex upload only fires on the merge-to-main commit, not on the PR.
• Verify dry-run override works: passing dry-run: false from a consumer surfaces a regression as a hard fail.

🤖 Generated with Claude Code