[drake-nominal]

Consolidate Rust and Python checks into .github/workflows/validate.yml (Code validation). Keep PR metadata checks in .github/workflows/pr.yml (PR structure), so title and description edits do not rerun builds or wheel tests. Use explicit, unique job IDs as required-check contexts; GitHub supplies the workflow prefix in its UI.

Require these exact GitHub Actions check names:

validate-pr-title
rust-format
rust-lint
rust-build-test
python-format
python-lint
python-wheel-test (abi3 3.10)
python-wheel-test (abi3 3.11)

Remove superseded contexts from the main ruleset, including entries containing workflow prefixes. The ruleset is not changed here. Semgrep's externally managed semgrep-cloud-platform/scan is unchanged.

Give Python formatting a separate lightweight Depot job. Its shared Just check and fix recipes use uv run --only-group dev --locked so it runs the locked Ruff version without building workspace bindings. Keep Python lint and typing together, Rust build and tests together, and the existing wheel-test matrix. All validation jobs run independently.

Run code validation on pushes to main and on PR open, reopen, and synchronize events across all target branches. Run PR structure on PR open, reopen, synchronize, and edit events. Python validation now also covers PRs targeting branches other than main.

Keep publishing separate in crates.yml and wheels.yml, preserving their distinct triggers and permissions. Keep Dependabot approval in deps.yml; remove the unused metadata-fetch action and scope its token to content read and PR write. The approval filter and command remain unchanged. Document CI/CD structure, naming, and required-check matching in .github/workflows/README.md, and label steps by their actual validation and tool. Update external links or workflow dispatch callers for renamed files.

Use a direct uv lock --check step instead of a shell error wrapper that reruns the command through backtick expansion. Use the same pinned Just action throughout code validation.

Independent of #367 and #368; revisit those after this cutover.

Validation: actionlint passes with custom Depot labels allowed. Parsed YAML checks confirm existing validation job commands and wheel matrices are preserved except for moving Python formatting to its own job. All 11 job IDs and 27 expanded check names are unique. Event coverage is verified: PR edits run metadata validation only, while code updates run both workflows. Both formatting check and fix pass for 12 files using a development-tools-only environment. The lockfile check passes. Parsed comparisons confirm publishing behavior and the Dependabot approval filter/command are unchanged; Dependabot approval and publishing were not exercised live. Pinned rustfmt, 51 unit tests, and 3 doctests pass locally. Publishing workflows were not dispatched; CI reruns after this update.