ci: cap open PRs at 4 with drafts and 2 ready for review

[hectorvent]

What does this PR do?

Describes the new open-PR limits (floci-loft decision 0021) and grants the caller workflow contents: write.

• CONTRIBUTING.md: at most 4 open pull requests, drafts included, and at most 2 ready for review; a 3rd ready PR is converted back to a draft and a PR opened beyond the 4th is closed.
• PR template (none in this repo; the org default covers it): the checklist line names both limits.
• .github/workflows/pr-limit.yml: contents: write, which the shared workflow in floci-io/.github needs to convert a PR back to a draft (the GitHub API refuses the token without it). The workflow still never checks out PR code.

Verification: actionlint 1.7.12 clean on the caller. No code changes.

Merge before floci-io/.github's ci/pr-limit-caps: the shared workflow requests contents: write, which only works once this caller grants it. Merging this first is harmless: the current shared workflow ignores the extra permission.

Related issues

None. Follows floci-loft decision 0021.

Checklist

• Commits are signed off for the DCO (git commit -s).
• Commit messages follow Conventional Commits.
• No AI attribution in commit messages (no "Generated by" / "Co-Authored-By: …-bot" trailers).
• Tests pass locally and new behavior is covered (compatibility tests where applicable).
• Docs updated if behavior or configuration changed.
• I have read the Contributing guide and agree to the Code of Conduct.
• I have no more than 2 open, non-draft pull requests and no more than 4 open pull requests in total (drafts included) in this repository (maintainers and dependency bots are exempt).

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Updates pull request limit enforcement workflow and policy.

This PR appears safe to merge ahead of the shared workflow update.

Summary

Updates CONTRIBUTING.md to allow four open PRs, including drafts, with at most two ready for review. Adds contents: write to support the shared workflow turning excess ready PRs into drafts.

• No actionable issues found.
• Merge this caller before the shared workflow update, as described in the PR.
• Could not add greptile_confidence because GitHub authentication is unavailable.

_{Reviews (2) · Last reviewed commit: "ci: cap open PRs at 4 with drafts and 2 ..." · Reviewed by Greptile}