feat(ci): gate v1 promotion behind a reviewed workflow and add a drift canary

[laurenhitchon]

What

• promote-v1.yml — the new promotion path for the v1 tag. workflow_dispatch with a target SHA, gated by the v1-promotion environment (required reviewer), pushes over RELEASE_DEPLOY_KEY. Machine-enforces the rules MAINTENANCE.md previously left to convention: target must be on main, all check runs green. Records the previous target in the run summary for rollback.
• v1-drift-canary.yml — weekly probe (same pattern as the ccc v10 canary) that opens a single labelled tracking issue when main carries week-old unpromoted changes to reusable-*.yml. Renovate's chore(deps) bumps never cut a release, so nothing else prompts a promotion — observed 2026-07-29: five action majors sat on main unpromoted with Release green.
• MAINTENANCE.md: promotion procedure rewritten around the workflow; emergency enforcement-disable fallback documented; stale troubleshooting row updated.

Why

v1 is the ref all 24 consumers execute reusable workflows from, with secrets: inherit. Promotion was a bare manual force-push with no gate, no audit trail, and no trigger for dependency-only changes. A follow-up adds a refs/tags/v* ruleset (DeployKey bypass) once this merges — this workflow must exist first or there is no promotion path.

Notes

• v1-promotion environment already created (required reviewer: @laurenhitchon, self-review allowed).
• Not synced to consumers (repo-local workflows; not in any sync group).
• actionlint clean.

[DFSIdigital]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR formalizes and automates promotion of the mutable v1 tag (used by downstream repos to run reusable workflows) by introducing a gated, audited promotion workflow and adding a weekly drift canary to detect when main has reusable-workflow changes that haven’t been promoted.

Changes:

• Add a reviewed, environment-gated Promote v1 workflow that validates the target commit is on main and has green checks before force-updating the v1 tag.
• Add a weekly “v1 drift canary” workflow that opens a single labelled tracking issue when main has week-old unpromoted changes to reusable-*.yml.
• Update MAINTENANCE.md to document the new promotion process, rollback, and drift detection.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
MAINTENANCE.md	Rewrites the v1 promotion procedure around the new workflow and documents drift + emergency fallback.
.github/workflows/v1-drift-canary.yml	Adds a scheduled workflow to detect and track promotion lag for reusable workflows.
.github/workflows/promote-v1.yml	Adds a manually triggered, environment-gated workflow to validate and move the v1 tag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.