ci: workflow_dispatch promotion to public (beta) + beta-to-stable

Promotion workflows for the release pipeline. promote-public publishes a tag to
the public repo's beta channel; promote-stable re-tags a finalised beta as a
stable vX.Y.Z. Both bound to the 'production' environment (required reviewer),
reading PUBLIC_REPO_SLUG/PUBLIC_REPO_TOKEN. Tree copy via scripts/promote.sh
excludes .git/.github so private CI never reaches the public repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/promote-public.yml

@@ -0,0 +1,39 @@
+name: Promote to public (beta channel)
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v0.10.0-beta1)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout private repo at the tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+          path: src
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Promote (clean release commit + tag)
+        run: |
+          git config --global user.name 'clusev-release'
+          git config --global user.email 'release@clusev'
+          chmod +x src/scripts/promote.sh
+          src/scripts/promote.sh "$PWD/src" "${{ inputs.tag }}" "$PWD/pub" "Release ${{ inputs.tag }}"
+      - name: Push to public
+        run: |
+          git -C pub push origin HEAD:main
+          git -C pub push origin "refs/tags/${{ inputs.tag }}"

.github/workflows/promote-stable.yml

@@ -0,0 +1,45 @@
+name: Promote beta to stable
+on:
+  workflow_dispatch:
+    inputs:
+      betaTag:
+        description: 'Beta tag to finalise (e.g. v0.10.0-beta3)'
+        required: true
+      stableTag:
+        description: 'Stable tag to publish (e.g. v0.10.0)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout private repo at the beta tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.betaTag }}
+          fetch-depth: 0
+          path: src
+      - name: Tag the same commit as stable (in the private repo, for traceability)
+        run: |
+          git -C src tag "${{ inputs.stableTag }}" "${{ inputs.betaTag }}^{commit}"
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Promote stable (clean release commit + tag)
+        run: |
+          git config --global user.name 'clusev-release'
+          git config --global user.email 'release@clusev'
+          chmod +x src/scripts/promote.sh
+          src/scripts/promote.sh "$PWD/src" "${{ inputs.stableTag }}" "$PWD/pub" "Release ${{ inputs.stableTag }}"
+      - name: Push to public
+        run: |
+          git -C pub push origin HEAD:main
+          git -C pub push origin "refs/tags/${{ inputs.stableTag }}"