ci: register pr-size as a caller fleet on the shared bump-callers.sh

[mattmillerai]

ELI-5

This PR started as "turn the one cursor-review bump robot into a dispatcher that
also handles pr-size." While it was open, main landed #38,
which generalized the same bump robot a different way: one shared script
(.github/bump-callers/bump-callers.sh) driven by a thin per-fleet entrypoint
workflow, and used it to add a second fleet (agents-md-integrity). This PR now
reconciles with that: instead of a second, competing dispatcher implementation,
it registers pr-size as a third fleet on the now-shared script, the same way
agents-md-integrity was added.

What changed (revised after merging in #38)

• bump-pr-size-callers.yml — a new thin entrypoint over
  .github/bump-callers/bump-callers.sh, mirroring bump-agents-md-callers.yml
  exactly: triggers on a change to pr-size.yml, uses the PR_SIZE_CALLERS
  variable, and is seeded ALLOW_EMPTY=true (the workflow hasn't landed yet, so
  the fleet grows as callers get added — no different from how agents-md-integrity
  onboarded).
• .github/bump-callers/README.md, bump-callers.sh's header comment,
  test-bump-callers.yml's path filters, and AGENTS.md updated for the third
  fleet.
• The original bump-callers.yml single-dispatcher design (registry + compare-API
  push resolution + workflows/dry_run dispatch inputs) is dropped — it
  would have re-forked the bump logic ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet #38 just consolidated into one script,
  which is exactly what ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet #38's own commit message (and this repo's AGENTS.md,
  "One bumper, not several") says not to do. The per-workflow paths: trigger
  each entrypoint already has does the same "only bump what actually changed"
  job the compare-API resolution was for, natively.

Verification

• shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh — clean.
• bash .github/bump-callers/tests/test_bump_callers.sh — 25/25 passing, unchanged
  (the shared script itself wasn't touched, only a new caller of it was added).
• python3 .github/agents-md-integrity/check_agents_md.py --root . — passes
  (pre-existing CODEOWNERS warning only).
• Diffed bump-pr-size-callers.yml against bump-agents-md-callers.yml to confirm
  only the intended per-fleet parameters differ (name, trigger path, VAR_NAME,
  TAG, WORKFLOW_FILE).

Judgment calls / notes for the reviewer

• No PR_SIZE_CALLERS variable is seeded yet — same bootstrapping as
  AGENTS_MD_CALLERS was: ALLOW_EMPTY=true makes the entrypoint a clean no-op
  until the pr-size rollout starts adding callers.
• If pr-size.yml lands under a different filename than assumed here, the fix is
  the WORKFLOW_FILE/path-filter in bump-pr-size-callers.yml alone.

Follow-up fix (same tick)

Restored permissions: contents: read (this PR's original zizmor-driven fix)
across all three bump-*-callers.yml entrypoints — main's #38 merge and
this PR's new bump-pr-size-callers.yml had all landed without an explicit
permissions: block. None of these jobs write via GITHUB_TOKEN (writes go
through the generated app token), so read-only is correct, and it now matches
every other workflow file in this repo (all of which declare explicit
permissions).

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5430e60c-cad9-42c6-9f91-a9f17d90cd91

📥 Commits

Reviewing files that changed from the base of the PR and between aa5ae62 and ed6b9ad.

📒 Files selected for processing (7)

• .github/bump-callers/README.md
• .github/bump-callers/bump-callers.sh
• .github/workflows/bump-agents-md-callers.yml
• .github/workflows/bump-cursor-review-callers.yml
• .github/workflows/bump-pr-size-callers.yml
• .github/workflows/test-bump-callers.yml
• AGENTS.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-3482-generalize-bump-callers

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-3482-generalize-bump-callers

---

_{Comment @coderabbitai help to get the list of available commands.}

[mattmillerai]

Self-review: clean at HEAD c26fe33.

• No unresolved review threads (bot or human).
• shellcheck + functional (25/25) and Socket Security checks green.
• CodeRabbit shows fail but the detail is "Review rate limited" (org-wide adaptive limit, not a finding) — not a defect in this diff; not chasing further re-triggers per the usual guidance on rate-limited bot checks.
• No branch protection on main, so nothing here is a hard merge block.

Ready for your merge.

[mattmillerai]

🤖 The reviews loop filed Linear follow-up ticket(s) for review thread(s) deferred as out of scope for this PR:

• BE-3916 — Trigger bump-cursor-review-callers.yml on .github/cursor-review/** changes, not just cursor-review.yml