fix(noema): skip workflow runs without PR context - #435

Summary

• skip Noema review early when a workflow_run event has no associated PR number
• keep fail-closed behavior for real PR review paths with a visible error reason
• add a workflow contract test so token exchange cannot run before PR context exists

Failure evidence

• Main workflow_run failure: https://github.com/ContextualWisdomLab/.github/actions/runs/29132364498
• Root cause from log: PR_NUMBER was empty and TOKEN_EXCHANGE_URL was unset, so the merged fail-closed path failed a non-PR workflow_run.

Verification

• py -m pytest tests/test_required_workflow_queue_contract.py tests/test_noema_review_gate.py -q
• py -m pytest -q
• npx -y @colbymchenry/[email protected] status