Remove approval block to run tests, lint, and annotations

[zzak]

These steps are designed so any code executed from the workspace happens inside an unprivileged docker container.

We would get faster feedback on PRs if these run instantly.

[matthewd]

Moving it is fine (I'd wondered why the lint checks were placed before it), but removing "this is an important security gate" with "avoid spending extra build resources" [do we really have enough PRs here for that to be important?] is clearly not okay.

[zzak]

is clearly not okay

You're 100% right, I was wondering how to update the messaging but meant to ask that in review. Sorry for not clarifying. How does bd7fd1a look?

avoid spending extra build resources

My original thought was not cost for BK, but that we had (have?) a max 100 agents available and one build can take a significant amount of them, so triggering a bunch of test CI runs will quickly result in many pending jobs. That is less common, given how few PRs we get but wanted to call that out in the review.