ci: ✨ make E2E tests optional with local attestation requirement

Add PR template with E2E attestation checkbox, a lightweight
attestation workflow that verifies the checkbox is checked, and
gate the E2E job behind a `run-e2e` label for on-demand CI runs.

Author: thkruz

.github/pull_request_template.md

@@ -0,0 +1,7 @@
+## Description
+<!-- Describe your changes -->
+
+## Testing
+
+- [ ] Unit tests pass (`npm test`)
+- [ ] E2E tests pass locally (`npm run test:e2e`)

.github/workflows/build-pipeline.yml

@@ -133,8 +133,11 @@ jobs:
   e2e-tests:
     name: E2E Tests
     needs: [lint, type-check, test, security-audit]
+    if: >-
+      (github.event_name == 'pull_request' &&
+      contains(github.event.pull_request.labels.*.name, 'run-e2e')) ||
+      github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
-    environment: e2e-approval
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4

.github/workflows/e2e-attestation.yml

@@ -0,0 +1,42 @@
+---
+name: E2E Attestation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+    branches:
+      - main
+      - develop
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  e2e-attestation:
+    name: E2E Attestation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check E2E Attestation
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const body = context.payload.pull_request.body || '';
+            const pattern = /- \[x\]\s+E2E tests pass locally/i;
+
+            if (!pattern.test(body)) {
+              core.setFailed(
+                'E2E attestation required: Please check the box in the PR description ' +
+                'confirming you have run E2E tests locally and they pass.\n\n' +
+                'Add this to your PR description:\n' +
+                '- [x] E2E tests pass locally (`npm run test:e2e`)'
+              );
+              return;
+            }
+
+            core.info('E2E attestation confirmed.');
+
+            await core.summary
+              .addHeading('E2E Attestation', 3)
+              .addRaw('Developer has attested that E2E tests were run locally and pass.')
+              .write();