[TASK] Add ADR-003: Versioning strategy for shared workflow references

[CybotTM]

Summary

Proposes a versioning strategy for how consumer repositories should reference
shared reusable workflows: use @main, with tags only for breaking changes.

This ADR is in "Proposed" status and requests feedback from maintainers.

Key argument

SHA-pinning shared workflows reintroduces the per-repo maintenance burden that
shared workflows are designed to eliminate. With @main, a fix to the shared
workflow automatically benefits all ~29 consumer repos. With SHA pins, every
consumer must be updated individually.

Context

As of July 2026, nine consumer repositories SHA-pin reusable-backport.yml, and their pins have already drifted across two different commits (161f3be vs 46ed94f) — most consumers silently miss the latest workflow fixes. The open migration PRs use @main. This ADR proposes standardizing on @main with clear rationale.

Note

The ADR is a self-contained RST file under Documentation/Decisions/; the repository has no rendered documentation structure yet (the merged #3 turned out to be the README instead), so render/toctree integration can follow separately.

Feedback requested

• Is @main acceptable for your workflow stability requirements?
• Would you prefer mandatory tags for all changes?
• Should branch protection rules be added to this repo? ([FEATURE] Add CI gate for the shared reusable workflows (lint, security, conformance, freshness) #16 proposes a CI gate over main as a concrete first step toward this.)