Make build-approved release pending PR workflows

.github/workflows/approve-pr.yml

@@ -0,0 +1,46 @@
+name: Approve PR workflows
+
+# A pull_request workflow cannot approve itself: GitHub can hold it before
+# any job starts. This workflow only runs trusted default-branch code and
+# releases the ordinary, unprivileged PR workflows after build approval.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+  actions: write
+
+concurrency:
+  group: approve-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  approve:
+    # Match build-pr.yml's events, including other labels applied while this
+    # PR still carries build-approved: each labeled event creates a build.
+    if: contains(github.event.pull_request.labels.*.name, 'build-approved')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Never check out the PR head or its merge ref with this write token.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - id: vouch
+        uses: mitchellh/vouch/action/check-user@f23dbb5e745334f97414ec70463ce7301071a661 # v1
+        with:
+          user: ${{ github.event.pull_request.user.login }}
+          allow-fail: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Approve this PR's pending build and test runs
+        uses: actions/github-script@v7
+        env:
+          VOUCH_STATUS: ${{ steps.vouch.outputs.status }}
+        with:
+          script: |
+            const approve = require('./.github/scripts/approve-pr-workflows.cjs');
+            await approve({ github, context, core, vouchStatus: process.env.VOUCH_STATUS });