ci: enable merge queue validation

[anchenqlw]

Summary

• add dedicated merge_group validation with the existing dco, preview, and validate contexts
• keep pull-request DCO authoritative and use a queue-admission attestation for the merge-group dco context
• use a cross-platform Node test runner and prove Demo and nested test-like files stay inert
• document the single-Maintainer SHA-bound diff-review and queue-admission boundary
• preserve the existing pull-request trust boundary and Demo-as-data policy

Validation

• npm run check
• authoritative PR-DCO and exact merge-group head_sha checkout contract tests
• temporary-repository test-runner fixture
• infrastructure and content queue admission bound to reviewed headRefOid with --match-head-commit
• real Merge Queue acceptance will run after this PR lands and Ruleset 20582196 is updated

Signed-off-by: 安陈 anchen.qlw@alibaba-inc.com