Switch to a manual check status for dependent PRs (#7117)

The labeling script will now directly set a check status for the PR as
`pending` when it marks something as dependent, and clear it when it no
longer is. This emulates a check that starts when marked as dependent
and runs until the last dependency lands, allowing automerge and other
workflows to work cleanly.

The branch protection rule will have to be updated to the new spelling.

This should do the same key thing as #7113, but integrated to the new
script.

Assisted-by: Antigravity with Gemini

.github/workflows/check_dependent.yaml

@@ -1,33 +0,0 @@
-# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
-# Exceptions. See /LICENSE for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-
-name: Check Dependent Label
-on:
-  pull_request_target:
-    types: [opened, synchronize, labeled, unlabeled]
-
-# This workflow runs as `pull_request_target` so that the check can't be
-# disabled or bypassed by the PR, but it doesn't need any permissions.
-permissions: {}
-
-jobs:
-  check_label:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
-        with:
-          disable-sudo: true
-          egress-policy: block
-          # prettier-ignore
-          allowed-endpoints: >
-            api.github.com:443
-
-      - name: Check for 'dependent' label
-        run: |
-          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'dependent') }}" == "true" ]]; then
-            echo "PR has 'dependent' label. Blocking merge."
-            exit 1
-          fi
-          echo "PR does not have 'dependent' label."

.github/workflows/check_dependent_pr.yaml

@@ -14,6 +14,7 @@ concurrency:
 permissions:
   contents: read
   pull-requests: write
+  statuses: write
 
 jobs:
   check_dependent_prs: