Prevent merging PRs directly in main with a failing Mergeable check, …

…except when an `mergeable:force-allow` label is present.

This serves to prevent accidental PR merges outside of Copybara, but is not actually enforced by branch protection.

PiperOrigin-RevId: 492255443

.github/workflows/mergeable.yml

@@ -0,0 +1,14 @@
+mergeable:
+  pull_requests:
+    label:
+      and:
+        - must_exclude:
+            regex: '^disposition/DO NOT MERGE'
+            message: 'Pull request marked not mergeable'
+        - must_include:
+            regex: 'mergeable:force-allow'
+            message: 'Pull requests should not be merged directly and should instead '
+              'be handled by Copybara.\n\n'
+              'To enable Github merges, add the `mergeable:force-allow` label. This should almost '
+              'never be used except for releases or as a break glass measure '
+              'after discussing with the team.'