Add Red Hat partner-certification-checker to CI

[ddemlow]

Requirement

We publish to Automation Hub already, but don't currently run Red Hat's own
partner-certification-checker anywhere in CI — so sanity/lint issues that would cause Automation
Hub to reject a publish only surface after we've already tried to release, instead of catching
them ahead of time. Please add the checker (pinned to a specific released version, currently
v3.0.0) to CI so this gets caught earlier, in whatever way fits the existing workflow setup best.

Coordinate with the Ansible-core/Python version reconciliation work

The checker's fixed sanity matrix and minimum Ansible-core version are the same numbers the separate version-reconciliation issue is
about. Landing both together avoids the checker immediately flagging our own version floor as out
of step with itself.

Reference (not a spec)

The checker's own README (github.com/ansible-collections/partner-certification-checker) documents
how to call it as a reusable workflow and what changed in v3.0.0 (fixed sanity matrix,
python-versions input replaced by origin-python-version, minimum Ansible-core bumped to
>=2.16.0). We'd defer to that README plus your own judgment on exactly where/how it fits into the
existing workflow set.

[ddemlow]

Ahead of this landing: a manual pass against the current certification requirements checklist (docs.ansible.com/projects/partner-certification-requirements/) turned up two things worth expecting once this actually runs:

The Ansible-core floor (meta/runtime.yml, currently >=2.15.0) is likely to get flagged — already tracked separately in #373, no new action needed here if that lands first or alongside this.
Two low-confidence items worth a specific look once real output is in: whether the README's changelog heading ("Release Notes and Roadmap") satisfies the requirement's exact "Changelog"/ "Release notes" wording, and whether a dedicated "Support" section is needed (the requirement frames it as recommended, not required, for third-party vendors — but cheap to add if the checker treats it as blocking).

Everything else reviewed manually (naming, licensing, README structure, changelog mechanism, dependencies, build configuration, role meta/main.yml files, .ansible-lint config) looked clean — flagging here in case the actual run disagrees, since a live run is more authoritative than a manual read.