Add build-gate orchestrator and convert workflows to reusable

[ehl-jf]

Replaces the `safe to test` label gate with a single GitHub Environment deployment
approval (`build-gate`). One maintainer approval per PR now releases both frogbot
and the test suite in a single run.

Changes

• `build-gate.yml` (new) — orchestrator with a `gate` job that requires the
  `build-gate` environment approval on `pull_request_target` runs (push and
  `workflow_dispatch` skip the gate). Frogbot and the test suite fan out behind
  `needs: gate`. A `build-gate-success` aggregator job provides a single stable
  required status check for branch protection.
• `test.yml` — converted to `workflow_call` + `workflow_dispatch`; removed
  `push` and `pull_request_target: [labeled]` triggers.
• `frogbot-scan-pull-request.yml` — converted to `workflow_call`; removed
  standalone `environment: frogbot` (gate job now holds the approval).
• `analysis.yml` — changed trigger from `pull_request_target: [labeled]` to
  `pull_request: [opened, synchronize, reopened]`. This workflow uses no platform
  secrets so `pull_request` is correct and safe for forks.

Required follow-up (repo settings)

• Create the `build-gate` GitHub Environment with Required reviewers.
• Repoint required status checks in branch protection to `Build Gate / build-gate-success`.

---

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• All static analysis checks passed.
• This pull request is on the master branch.
• I used gofmt for formatting the code before submitting the pull request.