ci: Redline review as a CI check

[askalf]

Redline moves into this repo's CI, the way askalf/dario#1423 did. .github/workflows/redline.yml calls askalf/askalf's redline-review.yml, pinned to askalf/askalf#60, on the redline self-hosted runner, for same-repo PRs that are not drafts. A newer push cancels the older run for the same PR.

Where fleet-status lists the workflows that refresh it, Redline is added, and the fleet-status tests pass.

Draft until this repo's redline runner is registered on the host; marking it ready is the first live run.

[sprayberry-redline]

Automated review from the Sprayberry Labs fleet code reviewer.
Reviewed by the gating lane (gating review).

Verdict: approve. No blocking findings at head b2ddda00609deb99cb5d3bf32347162800f96936.

What I checked:

• Exemption and CI. Both changed files are workflow configuration under .github/workflows/ (no script extension, nothing under actions/ or scripts/), so the PR is exempt from Breaker verification. gh pr checks 86 --required at the live head: analyze (javascript-typescript), docker-build and test all pass; the only pending context is fleet/review, which is this review.
• Pin. uses: askalf/askalf/.github/workflows/redline-review.yml@63e007ee5f514a32fbdaebaa313eacc5c44f852f (.github/workflows/redline.yml:23). I resolved that SHA myself: it is the merge commit of askalf/askalf#60 and compare/main...63e007ee reports identical, so the comment main 2026-09-25, askalf/askalf#60 is accurate.
• Callee contract. The called workflow declares a single required workflow_call input, runner-label (string), and this caller passes exactly that (runner-label: redline). The caller's permissions (contents: read, pull-requests: read) match the callee's declared permissions, so the reusable workflow is not asking for more than the caller grants.
• Guards. The job-level if (draft == false && head.repo.full_name == github.repository, line 20) duplicates the callee's own same-repo/non-draft guard, as the comment says; ready_for_review is in the trigger types so a draft that is marked ready gets its first run. The concurrency group is keyed on the PR number with cancel-in-progress: true, matching the body's "a newer push cancels the older run".
• fleet-status hookup. workflow_run.workflows gains Redline (fleet-status.yml:18), which is exactly the new workflow's name:; the existing workflow_run job filter already restricts to same-repo pull_request runs, so nothing else needed changing.
• Precedent. The new file is identical to askalf/dario's .github/workflows/redline.yml except for the runner label, as the body claims.
• Tell pass. No em dashes, filler or patch narration in the workflow comments, commit message, PR title or body.

Notes for the operator (non-blocking):

• Until the redline self-hosted runner is registered for this repo, any run of the Redline workflow will sit queued rather than fail, and fleet-status will not receive its workflow_run: completed event. If Redline is later added to the branch's required checks, do that only after the runner is confirmed online, or same-repo PRs will block on a check that cannot start.

I did not run anything locally; CI is the test signal.