[Parth Aggarwal (parth21999)]

Depends on #484.

Summary

Implements the trusted gate-loading design from #479, with failure-status handling and target-branch re-evaluation. Dependency auto-approval remains unchanged; no workflow-file exception is introduced.

• Consumer workflows load the gate from the target branch's deps/c-build-tools gitlink, resolved at an immutable branch snapshot and checked against official c-build-tools master history.
• The reusable workflow preserves the explicit SHA-pinned compatibility path for repositories without the submodule. On c-build-tools' own PRs, it loads the target branch's action.
• The required mrbot/two-human-reviewers status is reset to pending before loading, and failures attempt to publish an error against the same captured head/target.
• Base-branch edits trigger re-evaluation without requiring a new head commit; title/body-only edits are ignored.
• The action's snapshot contract prevents knowingly publishing a verdict for a changed head or target.
• Documents installation, staged landing, fork/manual-dispatch behavior, and the remaining PR-controlled-workflow enforcement boundary.

Validation

• 133 offline fixtures passed: 64 action-policy cases and 69 loader/status/snapshot cases, using actual inline Bash with fixture-only GitHub transport.
• Exercised both Git Bash and Linux Bash; the final Linux run passed all 133 cases.
• Workflow lint passed apart from actionlint 1.7.12's two independently verified unsupported job.workflow_repository / job.workflow_sha properties.
• Dependency pointers, auto-approval policy, and the prerequisite action are unchanged by this layer.

Landing

This is the upper layer of a two-PR stack. Merge the prerequisite composite-action PR first, then revalidate this PR against master.

Consumer installation is a separate human-reviewed rollout after each target branch's submodule contains the snapshot-contract action. Do not merge this PR by bypassing a missing-action bootstrap failure. The original #479 remains untouched.

GitHub API outages or missing status-write permission can prevent changing an existing status; freshness reads and writes are not atomic. This change does not claim to make a PR-controlled workflow tamper-proof.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Parth Aggarwal (parth21999)]

/AzurePipelines run

[azure-pipelines]

You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list.

[Parth Aggarwal (parth21999)]

/azp run Azure-C-Build-Tools-Gate

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.