Description

buildscripts/validate_rebase_merge.py currently only runs inside Evergreen patch builds, which adds a task to every PR's patch build. This PR makes it an on-demand GitHub Action instead:

• New .github/workflows/validate-rebase-merge.yml (modeled on fast-forward-merge.yml): a PR comment of exactly /validate_rebase_merge runs the script, reacts 🙈→👍/👎 to the triggering comment, and posts the failure output on the PR. It runs on the codebuild runner and sends Honeycomb telemetry like the other workflows.
• The Evergreen validate_rebase_merge task (etc/evergreen_yml_components/tasks/misc_tasks.yml) and the patch-only rebase-check variant (etc/evergreen_yml_components/variants/misc/misc.yml) are removed, so it no longer runs on every PR patch build.

The workflow synthesizes the ../expansions.yml file the script reads for the changed-files check (is_patch/github_pr_number/branch_name), and uses uv sync --locked --group core --group evergreen so the GH environment matches the repo's lockfile.

Testing

• bazel run //buildscripts:validate_evg_project_config — both etc/evergreen.yml and etc/evergreen_nightly.yml validate with the task/variant removed.
• bazel run //buildscripts:yamllinters — clean.

Notes

• The linked-CVE gate in the GH Actions run is skipped with a warning unless a JIRA_CVE_GATE_PAT secret is configured, mirroring the script's existing behavior.