Add organization-wide default pull request template

[xnoto]

Summary

Adds .github/PULL_REQUEST_TEMPLATE.md as the organization-wide default pull request template. GitHub applies default community health files from a public org .github repository to every repository that does not define its own template (verified: no makeitworkcloud repository currently has one, so there are no conflicts or overrides).

Template contents:

• Summary + Fixes # issue linking
• Type of change checklist covering the org's repo mix (bug fix, feature, docs, OpenTofu root/module, GitOps/kustomize/charts/SOPS, image, CI/reusable workflow, refactor, breaking)
• Validation — CI is the validation environment; prompt to link passing checks; reminder that generated/centrally distributed files come from their owning automation
• Impact and rollout — cross-repository impact, version pins, chart/image publication, Argo CD reconciliation, follow-up verification
• Safety and secrets — no plaintext secrets/decrypted SOPS/state/kubeconfigs/tokens; no local OpenTofu init/plan/apply/destroy/import/state operations run or claimed; breaking changes need rollback notes
• Optional AI-assistance disclosure comment

Guidance lives in HTML comments so it does not render in PR bodies. Individual repositories can override at any time by adding their own pull_request_template.md (repo-local .github/ > root > docs/ takes precedence over the org default).

Validation

• ci.yml pre-commit checks pass on this PR (trailing-whitespace, end-of-file-fixer, gitleaks, etc.)

Notes

• Content and delivery mechanism informed by industry adoption research (stevemao/github-issue-templates collection, Kubernetes/React/vscode/freeCodeCamp/Ansible templates) and Make IT Work Cloud operating invariants.
• References: GitHub docs — default community health files; knowledge base agent-knowledge @ 299e833e2b9817c56f6cbd27e4bc2fe156e83a45.