Add /lgtm and /hold slash-commands workflow (modelcontextprotocol#2381)

Adds a caller workflow for modelcontextprotocol/actions/slash-commands
that implements Prow-style PR approval via comment commands:

- /lgtm adds 'approved' label + bot APPROVE review
- /hold adds 'do-not-merge/hold' label
- Both gated by core/lead maintainers OR CODEOWNERS of changed files
- New commits invalidate approval automatically

The 'status' job is intended to become a required check in branch
protection, making the labels an actual merge gate.

Requires SLASH_COMMANDS_TOKEN secret (PAT with read:org — see action
README for scopes). Also requires the 'approved' and 'do-not-merge/hold'
labels to exist.

References @slash-commands branch of the actions repo while that PR is
open; will bump to @main after it merges.

Fixes modelcontextprotocol#2199

🏠 Remote-Dev: homespace

Author: localden

.github/workflows/slash-commands.yml

@@ -0,0 +1,47 @@
+name: Slash Commands
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [synchronize, opened, reopened, labeled, unlabeled]
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: read
+
+jobs:
+  # Parse and execute /lgtm, /hold, /unhold comment commands; invalidate
+  # approval when new commits are pushed.
+  handle:
+    if: >-
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request) ||
+      (github.event_name == 'pull_request_target' && github.event.action == 'synchronize')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: modelcontextprotocol/actions/slash-commands@slash-commands
+        with:
+          github-token: ${{ secrets.SLASH_COMMANDS_TOKEN }}
+          always-allow-teams: core-maintainers,lead-maintainers
+
+  # Merge-gate status check — make "Slash Commands / status" a required
+  # check in branch protection so the labels become enforceable.
+  status:
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require approval, block on hold
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          echo "Labels: $LABELS"
+          if ! jq -e 'contains(["approved"])' <<<"$LABELS" > /dev/null; then
+            echo "::error::Missing 'approved' label — have a maintainer or CODEOWNER comment /lgtm"
+            exit 1
+          fi
+          if jq -e 'contains(["do-not-merge/hold"])' <<<"$LABELS" > /dev/null; then
+            echo "::error::'do-not-merge/hold' present — resolve concerns, then comment /unhold"
+            exit 1
+          fi
+          echo "✅ approved and not held"