chore(deps): bump OMT-Global/bootstrap/.github/workflows/release-publish-reusable.yml from d9c5bc7e50f4bcc97e4b4d3d2efc64e4ab3dca50 to 05296606785553deb8f36e4f18313076dfc9646d

[dependabot]

Summary

• Bumps the pinned release-publish reusable workflow from d9c5bc7 to 0529660.
• Retains the audited Dependabot-only exemption: normal PR metadata and governance checks run because this branch contains a human CI-policy commit.

Governing Issue

No governing issue is linked: this is an automated Dependabot workflow-pin maintenance update.

Validation

• git diff --check origin/main...HEAD
• Ruby YAML parse of .github/workflows/pr-fast-ci.yml
• bash -n scripts/ci/check-pr-governance.sh
• bash scripts/ci/run-fast-checks.sh
• Required PR checks are expected to satisfy CI Gate.

Bootstrap Governance

• Changes are scoped to the automated dependency update and its review-requested CI hardening.
• No secrets, runtime auth, or machine-local environment files are committed.
• Auto-merge is unavailable until the required checks and review are satisfied.

Material change: no

Merge Automation

• Auto-merge is currently unavailable because the PR is awaiting required checks and review.

Notes

• The prior human CI-policy commit is signed off; the verifier confirms all-Dependabot exemptions cannot cover human-authored commits.

[athena-omt]

The workflow pin update is correct: the referenced reusable workflow at 0529660 only replaces two mutable action tags with immutable SHAs. Local action-pin validation passed. However, this PR is not merge-ready: Validate PR Description and Validate PR Governance fail, which causes CI Gate to fail. The Dependabot body lacks all required template sections, governing-issue/validation/auto-merge evidence, and the required Material change: yes|no declaration. Required next owner: repository/Dependabot automation owner must supply a policy-compliant generated PR body or explicitly exempt this trusted Dependabot update path, then rerun CI. Auto-merge is not enabled.

[athena-omt]

Request changes: the reusable-workflow pin update is correct, but current head adds a broad governance bypass. .github/workflows/pr-fast-ci.yml skips both PR Description and PR Governance solely when the PR author is dependabot[bot]; this PR demonstrates the gap because commit 4db4b141ac01caec40254987be63cfd2c18cf5e7 is authored by hephaestus-omt and changes CI policy, yet both jobs were skipped. A human can therefore add arbitrary commits to a Dependabot PR without DCO, material-change/ADR, or independent-review enforcement. Keep any necessary generated-body exemption narrow, but remove the job-level governance bypass and implement an audited bot-only path that verifies every PR commit is Dependabot; run normal governance whenever a human commit exists. Branch is current with main, CI is green, and no review threads are unresolved.

[athena-omt]

Request changes: the current head correctly limits the metadata/governance exemption to PRs whose every commit is authored by dependabot[bot]; this PR’s human and GitHub Actions commits cause the normal checks to run, as intended. However, CI Gate is failing because Validate PR Description and Validate PR Governance fail. The Dependabot body is not compliant with the required PR template, and commit 4db4b141ac01caec40254987be63cfd2c18cf5e7 lacks a DCO sign-off. Required next owner: Hephaestus/branch owner must provide compliant PR metadata and rewrite or replace the unsigned commit, then rerun CI. Auto-merge is currently disabled.

[athena-omt]

Request changes: this PR edits the checked-in rendered .github/workflows/pr-fast-ci.yml, but the canonical renderer in src/archetypes.ts still emits the prior workflow without verify-dependabot-commits, without the conditional metadata/governance checks, and without the added CI Gate dependency. Bootstrap-generated repos therefore will not receive this hardening, and a later regeneration can overwrite the checked-in workflow change. Update the renderer, regenerate the managed workflow, and add a renderer-level regression assertion that a mixed-author PR retains normal governance checks. The reusable-workflow SHA bump is correct; the current head is fresh, CI Gate is green, and targeted renderer tests passed locally after dependency installation.