feat(ci): Set up remote PR debugging via yarn debug-pr

[dschom]

Because

• Validating a branch end to end means checking it out and running the whole stack locally, which is slow and machine specific.
• CI already builds and boots that exact stack for the functional tests, then tears it down. Reaching it by hand takes several UI steps, and an SSH rerun needs a finished workflow, which the functional-test approval hold never allows in test_pull_request.

This pull request

• Adds a dev_stack workflow gated by a run_dev_stack pipeline parameter (default false, so ordinary pipelines never run it) with one self-contained Dev Stack (SSH) job: provision, nx build fxa-shared, migrations, start-services.sh, on the builder image.
• Gives functional-test-executor an image parameter; the default is unchanged, so the Playwright jobs are unaffected.
• Adds yarn debug-pr [--tunnel | --shell] [pr-number | branch] (_scripts/debug-pr.sh): triggers the workflow, cancels the first pass, reruns with enable_ssh, pins the host key CircleCI reports, and opens a tunnel and/or shell with a 20-minute session cap.
• Adds the /fxa-debug-pr skill, which boots the stack via --tunnel, reports when it is up, and can run Playwright (--project=local) against it.
• Skips store-artifacts on the job, since pm2 logs from a hands-on session would publish whatever the operator typed.
• Documents the flow, ports, access model and cost in .circleci/README.md.

Issue that this pull request solves

Closes: N/A

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: _scripts/debug-pr.sh; in .circleci/config.yml, the dev-stack job, the dev_stack workflow, and the executor image parameter.
• Suggested review order: the README section (it explains the flow), then config.yml, then the script, then SKILL.md.
• Risky or complex parts: the cancel/rerun choreography against the CircleCI API (a v2 rerun with enable_ssh requires a terminal workflow); the executor parameter (default preserved); session-end handling (hitting the cap cancels the job, a disconnect does not).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

• No ticket: dev-tooling change with no product impact.
• /fxa-security-review was run on an earlier revision; its Medium finding (pm2 logs from an interactive session published as artifacts) is fixed by skipping store-artifacts. The SSH rerun installs only the token owner's VCS keys, confirmed on a live job.
• Triggering, canceling and rerunning need project write access. Via the GitHub API: fxa-write and fxa-admins have push/admin; svcops and fxa-community are read-only.
• Exercised end to end on this branch. The first run surfaced that the migration patcher needs fxa-shared built (fixed with a build step); the second boots to a tunnel in about seven minutes, and severity-1 #smoke › can reset password passed against the tunnelled stack via /fxa-debug-pr.
• The job pins ci-builder-v10; bump it with the other -vN references when the images change.