T8966: extends central vyos/mergify + product T-ID rule

Onboard vyos/shim-signed to the central Mergify baseline via
`extends: mergify` and add the bot-excluded per-repo
`invalid-task-id` rule, matching the 49-repo IS-531 product fleet.

The 5 merge-protection gate labels were pre-created. Products
already enabled; no central-config change. Validated via the
Mergify config-simulator (200 OK). Rule body byte-identical to
the fleet canonical.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 41 insertions, 0 deletions

diff --git a/.github/mergify.yml b/.github/mergify.yml
new file mode 100644
index 0000000..2cc6e39
--- /dev/null
+++ b/.github/mergify.yml
@@ -0,0 +1,41 @@
+# yaml-language-server: $schema=https://docs.mergify.com/mergify-configuration-schema.json
+# Mergify configuration for vyos/shim-signed.
+#
+# Inherits the central baseline from vyos/mergify (its .mergify.yml on the
+# default branch). The central baseline provides:
+#   - conflict labeling (`conflicts`, `backport-conflict`)
+#   - convention-agnostic merge protections: loose PR-title gate
+#     (`invalid-title`), minimal-body gate (`invalid-body`, #body<80),
+#     and the WIP merge gate (`WIP`)
+#   - @Mergifyio command restrictions (org Maintainers + vyosbot)
+#
+# Onboarded to `extends` under the T8966 onboard-to-extends follow-up. The
+# per-repo rule below opts this product repo into the strict T<digits>:
+# convention. It is additive (a distinct rule name, not an `extends` override)
+# and bot-excluded, identical to the 49-repo product fleet (IS-531).
+
+extends: mergify
+merge_protections_settings:
+  reporting_method: check-runs
+
+pull_request_rules:
+  - name: Flag product T-ID format violation in PR title or commit messages
+    description: >
+      Product-repo convention: PR title and every commit's first line must
+      match `T<digits>: <text>` (optional `scope: ` prefix). Relocated from
+      the central config (T8966) so the T-ID convention is opt-in per product
+      repo. Name is intentionally distinct from any central rule name so this
+      stays additive (not an `extends:` override).
+    conditions:
+      - '-closed'
+      - '-merged'
+      - '-author~=\[bot\]$'
+      - 'author!=copilot-swe-agent'
+      - 'author!=vyosbot'
+      - or:
+          - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
+          - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+    actions:
+      label:
+        toggle:
+          - invalid-task-id