Add a (good faith) roll validation before publishing packages #448

Our official procedure for publishing packages developed under the dart-lang/ github org is to wait for them to be rolled to google3 and/or the Dart SDK before they are published to pub.

https://github.com/dart-lang/sdk/blob/main/docs/External-Package-Maintenance.md#publishing-a-package

It's very easy to omit that step today. We should add some gating which at the least asks the PR author to state that they have rolled the package.

My rough idea for the process is:

• Add some level of git history to the checkout for the firehose action
• Before adding the comment which gives a link to create the tag we look for a ROLLED_TO=<sha> or ROLLED_TO_<pkg>=<sha> in the PR opening comment and look for any diff in lib/ for any packages which are otherwise ready for publish.
• We enable roll checks by default, with an explicit opt-out by package name mechanism in the github action config.

The step is manual by the PR author to avoid the complication of getting the credentials to check anything about the actual state of google3. We can probably add an internal agent skill and deterministic CLI tool to read this state for googlers. We could have an actual check against DEPS in the SDK repo, but I think it's not worth the implementation since that can be rolled in to the infrastructure for checking google3.