Add organization-wide default pull request template

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,50 @@
+<!--
+Thanks for the pull request! Fill in the sections that apply and delete the rest.
+Anything inside HTML comments is stripped from the rendered PR.
+-->
+
+## Summary
+
+<!-- What does this change do, and why? Link the driving issue or discussion. -->
+
+Fixes #
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] Feature / enhancement
+- [ ] Documentation
+- [ ] Infrastructure (OpenTofu root or module)
+- [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
+- [ ] Container image
+- [ ] CI / reusable workflow
+- [ ] Refactor / cleanup
+- [ ] Breaking change
+
+## Validation
+
+<!--
+CI is the validation environment. Link the passing checks and state what they prove.
+Call out anything intentionally not validated here.
+-->
+
+- [ ] Required pull-request checks pass
+- [ ] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited
+
+## Impact and rollout
+
+<!--
+Cross-repository or runtime impact: producers/consumers, version pins, chart or image
+publication, Argo CD reconciliation, follow-up verification. Write "None" for
+self-contained changes.
+-->
+
+## Safety and secrets
+
+- [ ] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
+- [ ] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
+- [ ] Breaking or irreversible effects are described above with rollback notes
+
+<!--
+If an AI agent materially produced this change, disclose it here so reviewers can calibrate scrutiny.
+-->