CI: Add Gerrit change isolation verify workflow

[ModeSevenIndustrialSolutions]

Summary

Adds a dedicated organization-level required workflow that enforces
change isolation on Gerrit patchsets, with its own independent Gerrit
voting so its result is reported separately from other required checks.

Part of the effort to modernise the Linux Foundation Gerrit CI and
standardise on the centrally-managed reusable workflows in
lfit/releng-reusable-workflows (mirrors the already-modernised ONAP
model).

Design

The workflow is a thin dispatcher (on: workflow_dispatch, invoked by the
Gerrit → GitHub integration):

1. Clear change isolation vote — clears the prior vote via
   lfreleng-actions/gerrit-review-action.
2. Verify change isolation — delegates to the shared reusable
   gerrit-compose-required-change-isolation-verify.yaml@v0.8.1. No
   bespoke inline logic lives in this repository.
3. Set change isolation vote — votes the aggregated conclusion back to
   Gerrit (im-open/workflow-conclusion@v3.0.0).

Notes / follow-ups

• All uses: references are SHA-pinned to their latest releases.
• Passes zizmor --persona=auditor with zero findings (empty default
  permissions, minimal per-job scopes, documented actions: read). The
  secrets-outside-env allow-list is provided by the companion config PR
  (CI: Add zizmor auditor configuration #45), which should merge first.
• Org provisioning required (admin): this workflow relies on the
  existing LFIT_GERRIT_* org vars/secrets for its own vote steps, and the
  shared reusable additionally reads the plain vars.GERRIT_URL org
  variable for the Gerrit checkout. A repository Ruleset must map this
  workflow as a required check for the target Gerrit-mirrored repos.

Validation

• actionlint → clean
• yamllint → clean
• zizmor --persona=auditor --offline → no findings