migrate the external pipeline according to the details noted in the parent task (OCMUI-2632):

pr-check jobs for topic/long-lived branches (push to quay).

in addition:

cover ui-dev role permissions & self-service (see this comment).

our GH repo is private, so CI should probably remain on ci-int, and not moved to ci-ext! see this section in app-interface docs.

test that the pr-check job builds and pushes to quay.io.