chore(deps): bump OMT-Global/bootstrap/.github/workflows/release-postpublish-reusable.yml from d9c5bc7e50f4bcc97e4b4d3d2efc64e4ab3dca50 to 05296606785553deb8f36e4f18313076dfc9646d

[dependabot]

Bumps OMT-Global/bootstrap/.github/workflows/release-postpublish-reusable.yml from d9c5bc7 to 0529660.

Changelog

Sourced from OMT-Global/bootstrap/.github/workflows/release-postpublish-reusable.yml's changelog.

Governed Release Train

This repository uses release maturity level governed.

Manual Flow

1. Open a release train issue with .github/ISSUE_TEMPLATE/release_train.yml.
2. Create or update the release/{major}.{minor} release branch.
3. Run Release Preflight with the candidate version, channel, target ref, and release issue.
4. Copy the successful preflight run ID into the release issue.
5. Run Full Release Validation against the same target ref.
6. Copy the successful validation run ID into the release issue.
7. Create the exact release tag only after validation evidence exists.
8. Run Release Publish with the tag, preflight run ID, validation run ID, channel, and release issue.
9. Run or review Release Postpublish, then close or supersede the release issue.

Publish must consume the artifact bundle proven by preflight. If the preflight artifact cannot be downloaded or its recorded target SHA differs from the tag SHA, publish must fail instead of rebuilding.

Customization

Repo-specific behavior belongs in these hook scripts:

• scripts/release/prep.sh
• scripts/release/preflight.sh
• scripts/release/validate.sh
• scripts/release/build.sh
• scripts/release/publish.sh
• scripts/release/postpublish.sh

The generated defaults do not require secrets and do not publish external packages.

Commits

• 0529660 feat: project public security controls (#100)
• 1cf61f6 feat: complete conformance engine (#99)
• f12ba4a feat: add report-first issue hygiene (#98)
• e0dbbc7 feat: report stable license conformance (#97)
• e45df60 feat: add explicit licensing policy foundation (#96)
• 39af966 Request autoreview access before implementation (#94)
• 3d2f360 feat: add secure webhook delivery transport (#93)
• fc12033 test: restore conformance warning fixture (#89)
• 415b359 feat: project public security policy (#88)
• 31fbd79 fix: enforce generated ownership sidecar (#87)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[athena-omt]

The workflow pin update is correctly scoped and remains immutable; targeted release-postpublish and reusable-workflow tests pass. However, this head is not merge-ready: Validate PR Description and Validate PR Governance fail, which also fails CI Gate. Please have the PR coordinator replace or augment the Dependabot body with the repository-required sections and evidence, including a governing-issue/no-issue statement, validation status, merge-automation statement, and Material change: yes or Material change: no; then rerun CI and enable auto-merge when eligible. No unresolved review threads were found.

[athena-omt]

Blocking: commit f14dfbe changes the checked-in .github/workflows/pr-fast-ci.yml, but this workflow is generated by prWorkflow() in src/archetypes.ts. That generator still emits both human-validation jobs without the Dependabot exemption, so the next bootstrap apply will overwrite this behavior. No test covers the new bot-specific policy.

Please either remove this unrelated policy change from the dependency-update PR, or implement it as a complete generator change: update prWorkflow() in src/archetypes.ts, regenerate .github/workflows/pr-fast-ci.yml, and add targeted rendering coverage for both skipped jobs. Rerun CI after the fix; then enable auto-merge if eligible.

Evidence: live head is current with main, CI Gate and its completed checks are green, and local targeted workflow tests plus npm run typecheck passed. The release-postpublish reusable workflow pin remains an immutable SHA.

[athena-omt]

Approved. The current head fixes the prior generator-drift blocker by updating prWorkflow() alongside the checked-in workflow and adding rendering coverage for both Dependabot exemptions. The release-postpublish reusable-workflow pin remains an immutable SHA. The branch is current with main; CI Gate completed successfully, and no unresolved review threads were found. Local npm run typecheck passed. The isolated checkout lacks the Vitest package, so the adjacent render test could not be rerun locally; its current-head CI check is green. Auto-merge remains disabled and should be enabled by the control-plane finalizer after credential and head verification.