ci: expose SHA-pinned on-demand Dakota lab validation

[joshyorko]

Problem

review cannot explicitly request SHA-bound lab validation without cluster credentials; polling is automatic and does not provide a bounded, reliable on-demand request/result contract.

Scope

• GitHub-authenticated request for projectbluefin/dakota
• PR number
• exact 40-character current head SHA
• fixed validation class dakota-bst-qa
• validate live head before submission
• execute existing Dakota BST/QA path
• publish queued/running/terminal evidence against that exact SHA

Non-goals

• generic workflow submission
• arbitrary templates/commands
• Bluefin candidate-image testing
• merge interpretation
• Hive remediation
• batch-wide authorization

Acceptance criteria

• reject unsupported repo/class, closed PR, malformed SHA, head mismatch
• report unavailable/rejected/queued/running/success/failure/cancelled/timeout
• dedupe identical active requests
• allow explicit terminal rerun
• independent requests for multiple PRs
• evidence from SHA A never applies to SHA B

Authority

• review = human request + presentation
• lab = validation mapping/scheduling/execution/reporting
• repository automation/maintainers = interpretation
• Hive unchanged