Passes github.event.pull_request.number to the reusable workflow so
dual-approval status checks work correctly on PRs instead of always
receiving pr_number=0.
Adds the shared dual-approval caller workflow, mirroring all other
plugin repos. Enforces the CTO + QA dual approval policy as a GitHub
required status check.
Resolves the gap identified in PRI backlog (dd33f62f).