Gate external PRs on an assigned, linked issue

Unsolicited pull requests now outnumber issues four to one and almost none
are reviewable in the time we have. This adds a workflow that closes an
external PR unless its description links an open issue the author is
assigned to (or one labeled "help wanted"), and reopens it automatically
once a maintainer assigns them. Maintainers, triage-role collaborators,
bots and drafts are exempt; reopening a PR or removing the control label
is a sticky maintainer override. PRs numbered below 3200 predate the gate
and are only evaluated on manual dispatch.

The workflow is adapted from PrefectHQ/fastmcp's require-issue-link.yml
(itself from langchain), restructured into a single script that always
reads PR state live, requires linked issues to be open and in this repo,
finds gated PRs via the list API rather than search, and diagnoses a
refused reopen instead of guessing. It ships in dry-run: set the
PR_GATE_ENFORCE repository variable to "true" to enforce.

CONTRIBUTING.md is rewritten around the policy (issues are the
contribution; how PRs get in; who we want to hear from), AGENTS.md gains
an agent-facing statement of it, and a short repo-level PR template
leads with the Fixes line the gate looks for.

No-Verification-Needed: workflow and docs only; exercised with a mock harness, actionlint and zizmor

Author: maxisbey

.github/pull_request_template.md

@@ -0,0 +1,19 @@
+<!--
+PRs from outside the maintainer team are auto-closed unless they link an open
+issue you are assigned to (or one labeled `help wanted`). If that's not you
+yet, file or find the issue first — see CONTRIBUTING.md#how-pull-requests-get-in.
+Keep the description short: what changed and why, in your own words.
+-->
+
+Fixes #
+
+## What and why
+
+## How it was tested
+
+## Checklist
+
+- [ ] I'm assigned to the linked issue, it's labeled `help wanted`, or I'm exempt (maintainer / trusted contributor)
+- [ ] AI assistance, if any, is disclosed above and I can explain every line of this diff
+- [ ] Tests added/updated; `uv run --frozen pytest` and `uv run --frozen pyright` pass locally
+- [ ] Docs and `docs/migration.md` updated if behaviour or public API changed