ci: adopt pr-claim, so PRs here are checked against a live Front Desk claim - #15

Adds a thin caller of _pr-claim.yml in bounded-systems/.github.

What it checks. That a PR names an issue which is OPEN and still carries a claim — via Closes #N, or Claim-issue: owner/repo#N on its own line for work that runs under a claim without closing it (.github-private#723).

It reports; it does not yet block. This repo is in no ruleset naming pr-claim / pr-claim, so a red check here is information, not a refusal. That is deliberate and it is the ONLY safe order:

A required status check with no workflow producing it never reports. It sits pending forever, and every PR in the repo becomes unmergeable.

So the caller lands everywhere first; requiring the check org-wide is a separate, later change. Reversing the two bricks the org.

No credential. The reusable runs against THIS repository with THIS repository's built-in GITHUB_TOKEN. The read permissions are granted in the caller because a workflow_call callee can only ever narrow what it is handed — omit issues: read and the check cannot read a private issue, which it reports as unreadable and counts as not claimed.

What a green check does not mean. That an open, claimed issue was named — no more. An author can name any claimed issue, including someone else's. It does not authenticate the claimant (.github-private#530).

Claim-issue: bounded-systems/.github#280