[CI] Gate main merges on backports and release-branch unit tests

[Mikaayenson]

Summary

We only merge to main. Backport automation then pushes to the release branches, and Unit Tests run on those pushes. Another PR should not merge until that has succeeded.

Today's required checks (branch-status-checks (8.19) and the 9.x jobs) fail while those tests are still running. They can also pass against the previous tip if the new backport has not pushed yet.

release-line-caught-up is a single check. It stays pending until the current main commit is backported to every target and Unit Tests on those tips have succeeded. Then it goes green. If backport or tests fail, or if that has not happened within 28 minutes, it goes red.

Merge queues

GitHub's merge queue needs a stable required check that runs on merge_group, and it needs that check to stay pending while work is still in flight. The old matrix jobs fail immediately when tip CI is running, so queue entries get ejected. They also report as separate check names (branch-status-checks (8.19), and so on), which you have to keep in sync with the target branch list.

With this change, the queue serializes on the previous main merge:

1. PR A merges.
2. PR B enters the queue. Its release-line-caught-up job looks at origin/main (A) and stays pending.
3. A's backports push, then Unit Tests run on those tips.
4. backport.yml sets release-line-caught-up success on A's merge SHA.
5. B's check goes green and the queue can merge B.

If A's backport or tip tests fail, B's check goes red and the queue stops until that release line is fixed. Throughput is one main merge per backport-and-test cycle. That is the same rule we already have; the queue just waits instead of failing at t=0.

build and build-and-validate also run on merge_group, so the other required checks exist for queue entries.

Changes

• Deleted branch-status-checks.yml.
• backport.yml writes a release-line-caught-up commit status on the merge SHA after all targets are done (push, nothing to cherry-pick, or backport: skip).
• New workflow runs that check on pull_request and merge_group for main.
• build, build-and-validate, and code-checks also run on merge_group.
• Deleted manual-backport.yml.

Before this can merge

Those old check names will not run on this PR. On main branch protection:

1. Remove branch-status-checks (8.19), (9.3), (9.4), (9.5)
2. Require release-line-caught-up
3. Leave CLA, build, and build-and-validate

Until the first status exists, release-line-caught-up falls back to waiting for green Unit Tests on the current release tips. After this merges, later PRs wait on the commit status.

Turn on the merge queue after this PR is in main.

Test plan

• Remove the old branch-status-checks (*) required checks so this PR is not stuck waiting for jobs that no longer exist
• release-line-caught-up passes on this PR (tip Unit Tests fallback)
• After merge, the merge commit gets a release-line-caught-up status once release-branch Unit Tests pass
• On the next PR, release-line-caught-up stays pending until backports finish, then passes
• Enable the merge queue