Single-use CI approval label, and job names from _resolved

[mcocdawc]

Everything the CI rollout has open for this repo, as one pull request instead of a
two-deep stack. Supersedes #337 and #338 — same branch, same commits, no rebase;
GitHub simply refuses to retarget a PR that is part of a stack.

Two changes:

• Job names come from _resolved.job-name. One name, computed once by
  resolve-deps, instead of each workflow spelling out its own
  ${{ matrix.platform }}, ${{ matrix['cxx-compiler'] }} — which is how the CI
  and cross-repo lanes drift apart.
• The approved-for-ci label is single-use. require-ci-approval now spends
  the label the moment it is honoured, so one approval buys one run and a
  contributor cannot earn approval on a harmless diff and replay it. Adds
  .github/ci-approval-allowlist.yml for the legacy workflows that are exempt.

The regenerated trigger-downstream{,-hpc}.yml are what actually make downstream
CI green again: the orchestrator now resolves the commit under test through a
context job, and label-gate uses github.token with an explicit
permissions: block rather than a minted App token.

Why downstream CI is red without this

ci-infrastructure@main is at eab560cc, which changed the rendered orchestrator.
This repo's develop still carries the previous render, so the orchestrator's
validate job fails, every consumer job is skipped, and downstream/runner flips
to failure. Verified by re-running the generator's --check against develop
(stale) and against this branch (clean).

Merged develop in; it touched no CI files, and regenerating produces no delta.

🤖 Generated with Claude Code

https://claude.ai/code/session_015RsLA9yt5sthqAuLFjBHdm

🌦️ >> Documentation << 🌦️
https://sites.ecmwf.int/docs/dev-section/eckit/pull-requests/PR-340

Contributor Declaration

By opening this pull request, I affirm the following:

• All authors agree to the Contributor License Agreement.
• The code follows the project's coding standards.
• I have performed self-review and added comments where needed.
• I have added or updated tests to verify that my changes are effective and functional.
• I have run all existing tests and confirmed they pass.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.60%. Comparing base (6dc80ce) to head (3e205f6).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #340      +/-   ##
===========================================
+ Coverage    67.55%   67.60%   +0.04%     
===========================================
  Files         1182     1182              
  Lines        61862    61862              
  Branches      4675     4675              
===========================================
+ Hits         41793    41822      +29     
+ Misses       20069    20040      -29     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[marcosbento]

Ready!