ci: add merge guard workflow for fixup commits and do-not-merge label

.github/workflows/check-do-not-merge.yaml

@@ -0,0 +1,21 @@
+name: Check Do Not Merge
+
+on:
+  pull_request:
+    branches:
+    - main
+    types: [opened, reopened, labeled, unlabeled]
+
+jobs:
+
+  check-do-not-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Block merge if do-not-merge label is present
+        env:
+          HAS_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'do-not-merge') }}
+        run: |
+          if [ "$HAS_LABEL" = "true" ]; then
+            echo "::error::PR has the 'do-not-merge' label. Remove it before merging."
+            exit 1
+          fi

.github/workflows/check-fixup-commits.yaml

@@ -0,0 +1,24 @@
+name: Check Fixup Commits
+
+on:
+  pull_request:
+    branches:
+    - main
+
+jobs:
+
+  check-fixup-commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check for fixup or squash commits
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          COMMITS=$(git log --oneline "origin/${{ github.base_ref }}..HEAD" --grep="^fixup!" --grep="^squash!" --format="%h %s")
+          if [ -n "$COMMITS" ]; then
+            echo "::error::PR contains fixup/squash commits that must be squashed before merging:"
+            echo "$COMMITS"
+            exit 1
+          fi