Create a shared `gh-workflow-approve` workflow

The goal of this issue is to create a reusable workflow that decides whether a fork's code gets to run in CI. Each subproject currently has its own implementation. A target end state for this issue is to reduce existing divergence and to align on a shared standard to meet cross-project compatibility and ecosystem governance goals.

Start by inventorying the separate fork-approval workflow implementations used by each subproject and compare their behavior. Define the shared standard and compatibility requirements before consolidating them; done means a reusable gh-workflow-approve workflow reduces divergence and supports the stated ecosystem governance goals.

Written by the indexing model from the issue text.