[codex] Fix OB1 gate empty workflow runs

[justfinethanku]

Summary

• switch the OB1 gate to pull_request_target so conflicted PRs can still produce real gate results instead of zero-job failures
• add explicit push/main and workflow_dispatch handling with a guard job so merge pushes do not create empty workflow failures
• add a non-PR guard to the follow-up workflow so push-triggered gate runs do not cascade into another zero-job workflow
• keep pull_request_target safer by using read-only permissions and validating metadata against the base-branch schema

Root Cause

GitHub was creating .github/workflows/ob1-gate.yml runs with zero jobs. Recent evidence showed push events on main plus PR force-push/conflict cleanup. GitHub documents that pull_request workflows do not run when a PR has merge conflicts, which matches the noisy PR examples.

Validation

• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "parsed #{f}" }' .github/workflows/ob1-gate.yml .github/workflows/ob1-pr-followups.yml\n- git diff --check\n- npx --yes node-actionlint .github/workflows/ob1-gate.yml .github/workflows/ob1-pr-followups.yml\n- live manual run on this branch: https://github.com/NateBJones-Projects/OB1/actions/runs/26184769762 (OB1 Gate Event Guard ran successfully; OB1 Review skipped as intended for workflow_dispatch)\n\n## Note\nThe changed pull_request_target workflow will only become active for PR events after this lands on main, because GitHub evaluates pull_request_target workflows from the default branch.