ci: adopt shared reusable lint-pr workflow

[supertokens-agent-runner]

Problem

supertokens-python carried its own full copy of the PR-gate workflow in
.github/workflows/lint-pr.yml (semantic PR-title lint + changelog-fragment
check). The same file is duplicated across the backend SDK repos, so any change
to the gate has to be hand-propagated — a drift surface. supertokens/actions
now hosts a reusable workflow_call version of exactly this gate.

Fix

Replace the local job definitions with a thin caller of the shared reusable
workflow:

jobs:
  lint:
    uses: supertokens/actions/.github/workflows/lint-pr.yml@main

The trigger (pull_request types) and the concurrency block are kept
identical to the previous file. The two jobs (Lint PR Title via
amannn/action-semantic-pull-request@v6 with validateSingleCommit: true, and
Require Changelog Fragment checking .changes/unreleased/ with the
Skip-Changelog escape hatch) are byte-for-byte the same logic that already
lived here — I diffed the inlined jobs against the shared workflow on
actions@main and they match. This removes the drift surface, not the gate.

Tests

No runtime code changed — this is a CI-workflow-only change, so there is no unit
test to add or run. Validation performed:

• Confirmed supertokens/actions/.github/workflows/lint-pr.yml@main exists and
  its lint-pr-title / lint-changelog jobs are identical to the jobs being
  removed here (dependency unit A1 is merged).
• YAML parse-check on the new caller and the changelog fragment.
• The gate exercises itself on this very PR — see the checks below.

Not verified

• Did not run the Python test suite / make lint / build: nothing Python
  changed, and those target the SDK source, not workflow YAML.
• Branch-protection check names change with this migration: required
  contexts move from Lint PR Title / Require Changelog Fragment to
  lint / Lint PR Title / lint / Require Changelog Fragment (nested under the
  caller job lint). A repo admin will need to update the required-status-check
  names in branch protection for dev so the gate stays enforced. Flagging for
  the reviewer — I can't change branch protection.

Cross-SDK note

This is the Python instance of a standardization applied across the SDKs:

• golang has the equivalent local lint-pr.yml → its own unit (A4).
• node has the equivalent local copy plus a legacy changelog-enforcer to
  retire → its own unit (A2).

Python's gates already matched golang's normative set, so this PR is a pure
extract-to-shared with no behavior change. Ports for node/golang are separate
units — flagged, not made here.

Part of PLAN-001.

Fixes #640

[supertokens-agent-runner]

CI triage

Passing (relevant to this change):

• lint / Lint PR Title ✅ and lint / Require Changelog Fragment ✅ — the shared reusable workflow runs and gates exactly as the old inline copy did.
• Check linting and formatting on Python 3.8–3.13 ✅ — confirms no Python impact.

Failing — pre-existing, NOT caused by this change:

• test-gate (×4) ❌. These fail with No test label found. Add 'run-tests' to run tests, or 'skip-tests' to explicitly bypass. (job env shows LABELS: []). This is the repo's PR test-label policy gate, independent of the workflow file this PR touches — it fires on any PR that carries neither the run-tests nor the skip-tests label. The underlying test jobs are skipping, not failing. Adding a test label is a human triage decision (analogous to Skip-Changelog), so I've left it for the reviewer: add skip-tests (this is a CI-YAML-only change with no runtime surface) or run-tests if you want a full run.

Reviewer action needed (branch protection): with the move to the reusable workflow, the two check contexts are now reported as lint / Lint PR Title and lint / Require Changelog Fragment (nested under the caller job lint), rather than the previous top-level Lint PR Title / Require Changelog Fragment. If those are required checks on dev, the required-context names need updating so the gate stays enforced. I can't change branch protection.

[supertokens-agent-runner]

Thanks for the review and approval, @porcellus.

Confirming the state after the skip-tests label was added:

• CI is fully green: 17 checks pass, 9 skip by design (the test matrix jobs, gated off by skip-tests), 0 failing.
• The test-gate failures flagged in my triage above have cleared — they were the label-policy gate firing on an unlabelled PR, exactly as noted, and adding skip-tests resolved all four.
• No code changes were needed in response to review — the approval carried no comments or change requests, and this remains a CI-workflow-only change with no runtime surface.

One human/admin action still outstanding (unchanged from my triage note, cannot be done from here): with the move to the reusable workflow the two gate contexts now report as lint / Lint PR Title and lint / Require Changelog Fragment (nested under the caller job lint). If those are required status checks on dev, the required-context names in branch protection need updating so the gate stays enforced before/at merge.

Ready for merge at your discretion.