ci: remove the ruby dependency from the org reusable workflows (#153)

* ci: remove the ruby dependency from the org reusable workflows

Codex Rails failed on ARC in 7s with `ruby: command not found`. The Hetzner
runner image ships Ruby 3.1.2; the ARC image ships none. Both workflows used
Ruby only as a YAML/JSON parser and as the host for the review-thread guard.

Restores codex-rails-check.yml and review-thread-guard.yml into this repo
(removed at 0783dc1 when the engine moved to .github-private) with Ruby
replaced by python3 + PyYAML, and ports check-pr-review-threads.rb to
check_pr_review_threads.py using the standard library only.

PyYAML is present on both runner images, verified by probing them rather than
by reading a Dockerfile. Because "the image has the library" is exactly the
assumption that silently broke the deploy cost gate, both workflows now assert
their toolchain up front and self-test against fixtures that must fail. A guard
that stops verifying goes red instead of green.

Also drops the dead `blacksmith-4vcpu-ubuntu-2404` runner default, which would
queue forever rather than fail, and makes the Ruby test step fail loudly
instead of skipping when a repo has a Ruby suite and the runner has no ruby.

The Python port matches the Ruby original on 190 differential cases across 19
payload fixtures, 5 severities and both --include-outdated settings.

Consumers pin this repo by SHA and must bump both `uses:` and `guard_ref`.

* docs: stop naming private repositories in a public workflow comment

The header comments I added in 5721334 listed the organisation's private
consumer repositories by name, and named a specific private repo's protected
branch, inside a repository that is public. That is the same disclosure the
automation move at 0783dc1 was meant to avoid.

Reworded to describe the constraint without the inventory. No behaviour change;
comments only. Landed as a new commit rather than an amend, since 5721334 is
already pushed.

Author: haasonsaas