Follows canonical pattern from headlamp-sealed-secrets-plugin.
The pull_request trigger now fires on [uat, main] so the promotion
gate check auto-runs on PR open/sync for dev→uat PRs, not just
on review events.
headlamp-argocd-plugin was missing the dual-approval (CTO + QA) gate
required by SDLC. Added identical workflow to all other plugin repos.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fixes PRI-524. Changes push trigger from branches:[main] to branches:['**'] so CI fires on every branch. Adds workflow_dispatch for manual trigger. Adds permissions: contents: read for least-privilege hardening.
All gates clear: CI green, UAT correctly skipped (YAML-only), QA approved (Regina), CTO approved (Nancy).