[jon8787]

What

Adds .github/workflows/check-jira-key.yaml — the caller for the check_jira_key required-status-check (UID2-7426). First of ~24 identical rollouts, opened alone for review before fanning out to the rest.

Behaviour

• Runs on pull_request (opened / edited / synchronize / reopened) and calls IABTechLab/uid2-shared-actions/actions/check_jira_key@v3.
• Fails a PR unless the squash commit that will land carries a UID2-<n> key or a reasoned [no-jira - reason: <reason>] opt-out (mirrors the native ruleset on the enterprise orgs; IABTechLab is team-plan so the native rule is inert there).
• Non-blocking for now — the check runs and reports, but isn't a required check until the terraform required_status_checks rule is flipped on (separate step, after a bake).
• Job name pinned to check_jira_key so every repo yields the same status-check context → one terraform required-check entry matches all 24.

⚠️ Do not merge yet

Merge only after uid2-shared-actions #254 is merged and a release has moved the v3 tag to include actions/check_jira_key. Otherwise, once this lands on main, future PRs here would fail to resolve the action at @v3.

(Safe to leave open in the meantime: pull_request workflows run from the base branch, which doesn't have this file yet, so the check does not run on this PR itself.)

Rollout

Once this shape is approved, the identical file goes to the other 23 in-scope IABTechLab uid2* repos.