Add team freeze guard workflow (#12437)

Add team freeze guard workflow

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Rename file to .yaml

Update .github/workflows/README.md,

Update TFG to 0.0.4

Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>

Author: cbeauchesne

.github/workflows/README.md

@@ -129,6 +129,16 @@ _Recovery:_ Re-write the new Groovy files in Java / JUnit. To override this chec
 
 _Notes:_ The override label skips the workflow entirely.
 
+### team-freeze-guard [🔗](team-freeze-guard.yaml)
+
+_Trigger:_ When a pull request is opened, reopened, synchronized, labeled, unlabeled, or marked ready for review.
+
+_Action:_ Fail the check if the pull request author or the last committer belongs to a team currently listed in the `frozen-teams` input, blocking the PR from merging.
+
+_Recovery:_ If your PR is not dedicated to fix CI issue, it'll be block until the incident is resolved. If your Pr aims to fix CI issues, add one of the configured labels: `comp: testing`, `comp: tooling`, `tag: flaky test`, `tag: flaky test/disabled` to the pull request.
+
+_Notes:_ Configure frozen teams by editing the `frozen-teams` input in the workflow file (empty string means no team is frozen; otherwise list `@DataDog/<team>` entries one per line).
+
 ## Code Quality and Security
 
 ### analyze-changes [🔗](analyze-changes.yaml)

.github/workflows/team-freeze-guard.yaml

@@ -0,0 +1,41 @@
+# How to configure:
+#
+# When no team is frozen, set `frozen-teams` to an empty string:
+# frozen-teams: ""
+#
+# When one or more teams are frozen, add them one per line with the @DataDog prefix:
+#
+# frozen-teams: |
+#   @DataDog/team-a
+#   @DataDog/team-b
+
+name: Team freeze guard
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+      - ready_for_review
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  team-freeze-guard:
+    name: Team freeze guard
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: DataDog/team-freeze-guard@e4ff51a72cac229b238e5a302af0d3d955ae5b54  # v0.0.4
+        with:
+          bypass-labels: |
+            comp: testing
+            comp: tooling
+            tag: flaky test
+            tag: flaky test/disabled
+          frozen-teams: ""