chore(ci): add dormant push-email notification workflow (#39)

Backfills the dormant push-email workflow (gated by
vars.PUSH_EMAIL_ENABLED; needs org SMTP secrets to send). Inherited by
new repos from rsr-template-repo; this places it on an existing repo. No
effect until armed.

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- Briefly describe what this PR does and why. Link to related issues
with "Closes #N". -->

## Changes

<!-- List the key changes introduced by this PR. -->

-

## RSR Quality Checklist

<!-- Check all that apply. PRs that fail required checks will not be
merged. -->

### Required

- [ ] Tests pass (`just test` or equivalent)
- [ ] Code is formatted (`just fmt` or equivalent)
- [ ] Linter is clean (no new warnings or errors)
- [ ] No banned language patterns (no TypeScript, no npm/bun, no
Go/Python)
- [ ] No `unsafe` blocks without `// SAFETY:` comments
- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [ ] SPDX license headers present on all new/modified source files
- [ ] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state
changed)
- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations
changed)
- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural
decisions changed)
- [ ] Documentation updated for user-facing changes
- [ ] `TOPOLOGY.md` updated (if architecture changed)
- [ ] `CHANGELOG` or release notes updated
- [ ] New dependencies reviewed for license compatibility (MPL-2.0 /
MPL-2.0)
- [ ] ABI/FFI changes validated (`src/interface/abi/` and
`src/interface/ffi/` consistent)

## Testing

<!-- Describe how you tested these changes. -->

## Screenshots

<!-- If applicable, add screenshots or terminal output demonstrating the
change. -->

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/push-email-notify.yml

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: MPL-2.0
+# Dormant push-email notification. ARMED by setting the repo variable
+# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
+# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
+# new repos from the template; placed on existing repos by the farm sweep.
+name: Push email notification
+on:
+  push: {}
+permissions:
+  contents: read
+jobs:
+  notify:
+    name: Email on push
+    if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send push notification email
+        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        with:
+          server_address: ${{ secrets.SMTP_HOST }}
+          server_port: ${{ secrets.SMTP_PORT }}
+          secure: true
+          username: ${{ secrets.SMTP_USER }}
+          password: ${{ secrets.SMTP_PASS }}
+          from: "GitHub Push <${{ secrets.SMTP_USER }}>"
+          to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk"
+          subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}"
+          body: |
+            Repository: ${{ github.repository }}
+            Branch:     ${{ github.ref_name }}
+            Pusher:     ${{ github.actor }}
+            Compare:    ${{ github.event.compare }}
+            Head msg:   ${{ github.event.head_commit.message }}