Install the fleet no-op merge guard shim — a PR must not merge green and change nothing

.github/workflows/empty-pr-guard-shim.yml

@@ -0,0 +1,43 @@
+# empty-pr-guard shim — puts this repo's PRs under the fleet's no-op merge
+# guard in toon-meta (connector#1008: a PR merged green, closed its ticket,
+# and changed zero files).
+#
+# CANONICAL COPY. This file is fanned out VERBATIM to every factory repo as
+# .github/workflows/empty-pr-guard-shim.yml (toon-meta itself needs no shim —
+# its empty-pr-guard.yml carries the same trigger directly). When onboarding a
+# new factory repo, copy this file unchanged; when changing it, change it here
+# first and re-fan-out. Verify it actually landed in every repo before relying
+# on it — the #329 lesson (a shim that only exists as a canonical copy was
+# never installed).
+#
+# Same fleet convention as pr-housekeeping-shim.yml / auto-merge-shim.yml
+# (thin per-repo shim → toon-meta reusable workflow via workflow_call), kept as
+# a SIBLING file so a problem in one forwarder cannot take down another.
+#
+# TWO THINGS THIS SHIM DOES NOT NEED, both unusual for a shim here:
+#   * no `secrets: inherit` — the guard reads nothing but the PR's own merge
+#     ref via the default GITHUB_TOKEN's checkout, and makes no API call and no
+#     write of any kind. Handing it FACTORY_OPS_TOKEN would widen a monitored
+#     credential (#271) for nothing.
+#   * no branch filter — this is not factory plumbing that only matters on
+#     `sandcastle/` and `agent/` branches. A human's duplicate PR is exactly
+#     what merged empty in connector#1008, so every PR is checked.
+#
+# `synchronize` is not optional: a PR that had a real diff can BECOME a no-op
+# when its branch is updated onto a base that has since acquired the same
+# content. That is the #1008 shape, and under strict branch protection (#272)
+# a stale PR must be updated before it can merge — so this trigger is what
+# re-asks the question at the last moment before the merge button lights up.
+
+name: empty-pr-guard-shim
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  empty-pr-guard:
+    uses: toon-protocol/toon-meta/.github/workflows/empty-pr-guard.yml@main