Follows canonical pattern from headlamp-sealed-secrets-plugin.
The pull_request trigger now fires on [uat, main] so the promotion
gate check auto-runs on PR open/sync for dev→uat PRs, not just
on review events.
headlamp-argocd-plugin was missing the dual-approval (CTO + QA) gate
required by SDLC. Added identical workflow to all other plugin repos.
Co-Authored-By: Paperclip <noreply@paperclip.ing>