Workflow to require freshness of PRs

While some GitHub Actions always run from `main` depending on the trigger, others may run from the base branch which, for long-lived feature branches, may be stale. For this and related reasons, we should add a workflow that is less aggressive than GitHub's "require branches be up to date" when merging, but still a required check that requires some amount of freshness on typical PR triggers like creation and updates (pushes).

For example, when merging into a branch you can be no more than N commits behind. If that base branch is not `main` (or the default, in general), also require merging `main` into the base branch. Or something like that.

Start by reviewing the repository's existing GitHub Actions workflows and their pull-request triggers. Determine how branch freshness is currently evaluated and clarify the intended limits for commits behind and non-default base branches. Done should be a required check that enforces an agreed freshness policy without the full strictness of requiring branches to be fully up to date.

Written by the indexing model from the issue text.