promote.yml: declares engine contract 1 and takes the auto-pin's canary dispatch

[MattJackson]

The auto-pin (busbar-release autopin.rs) was held with predev's promote.yml declares no BUSBAR_RELEASE_CONTRACT (its top-level env). Its canary dispatches promote.yml on predev with the inputs engine_ref and engine_sha256, and this file had no workflow_dispatch.

What changes

• Contract. The top-level env declares BUSBAR_RELEASE_CONTRACT: 1, which is today's shape (the hop holds the R2 write keys). contract::declared reads it as 1. Engine 7ab2191 does not read the variable.
• The canary trigger. workflow_dispatch takes two required string inputs, engine_ref and engine_sha256.
  • On a dispatch, the preflight's Engine step uses the inputs in place of vars.ENGINE_REF / vars.ENGINE_SHA256.
  • The inputs reach the step as env and are never interpolated into the script.
  • They go through the same 40-hex and 64-hex checks and the same sha256sum -c check. A dispatch on any ref other than predev fails.
  • $GITHUB_ENV passes them to the preflight's busbar-release checkout and to ci preflight. The job outputs pass them to every other job.
• What a canary judges. It re-judges predev's tip the way the merge group that landed it did, on the canary engine:
  • SHA is github.sha and TO is github.ref_name (predev).
  • Its base is the tip's first parent. The preflight computes it and outputs base_sha, and hop-shard / hop read it when there is no pull request or merge group. This keeps the standing reds excused as they were.
  • The engine writes one_runner=false (the event is not a pull request), so the four shards and the fold run. slsa-build and soak stay skipped, as they are for predev.
• No writes beyond a pull request's.
  • publish (sticky comment, health issue, fallback) does not run on a dispatch.
  • The shards hold no R2 key on a dispatch, because predev's merge-group plan carries --store-as-base (a landed base report) and the keys are this file's only switch over that write. A canary therefore builds uncached.
  • The preflight's ORPHANS / R7 writes are merge-group-only in both engines.
• Concurrency is unchanged. R5 holds the line exactly in 7ab2191. A dispatch names no pull request or merge group, so its group is promote-. It never queues behind or replaces a pull request's or a merge group's run.

Checked against

• Engine 7ab2191 R5/R6 wiring_drift: no drift.
• Engine 2371310 R5/R6: this PR adds no drift. predev's file already drifts on five fields: the preflight's read-only permissions, preflight-act ×3, and slsa-build's || needs_release_artifact == 'true'. promote.yml: read-only R2 keys for the judge, cache-publish writes, the oracle pinned in busbar (engine contract 2) #755 / promote.yml: slsa-build runs where the rung reads the release artifact (unblocks #740); workflow-rules R18 #757 carry those.
• busbar workflow-rules R1/R11/R14/R15/R16/R17: clean.
• Every selftest mutation anchor still edits the file and turns R16/R1 red.
• actionlint: no new findings.

[MattJackson]

Superseded: #755 declares the engine contract (2) with the migration the new engine's wiring check needs. The workflow_dispatch canary can't work here because GitHub only dispatches workflows that exist on the default branch (main has none), so the auto-pin canary moves into busbar-release (a local wiring/contract check plus the trust replay).

[github-actions]

promote into predev: BOARD @37750da6f: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:deps	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:law0	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	kind-isolation:faces	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base 477c11d3d: 0 new red, 0 worse, 5 standing (excused).

tests passed: 24448, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38116686752 . Artifact verdict-37750da6f0506b931778c8cc1d18642ea3f79c18 (failures.json, junit.xml, raw.log; 90 days).