Automate post-tag wheel publishing handoff

[dkirov-dd]

Summary

• make the legacy GitLab release job dispatch GitHub wheel publishing after signing, tagging, and triggering the legacy build
• disable merge-driven GitHub release runs and remove the source-repository approval gate
• invoke integrations-core at the exact signed SHA with create-tags: false
• replace the GitHub tag-write STS policy with a protected-branch GitLab actions: write dispatch policy
• preserve dispatch failures through the timestamp pipeline and revoke the short-lived token on exit

Release flow

merge M → legacy signing commit S → tags at S → legacy build trigger → GitHub workflow_dispatch(source-repo-ref=S)

GitLab remains the sole tag writer. GitHub receives contents: read only and detects packages from existing tags at S.

Verification

• bash -n and ShellCheck for both release scripts
• mocked success/retry/failure/token-revocation tests for the dispatch script
• workflow/policy static contract checks
• actionlint passed
• git diff --check

Downstream compatibility

The existing central builder trust policy already permits workflow_dispatch on integrations-extras master through integrations-core's reusable workflow. Builder-to-TUF dispatch remains unchanged, and the TUF release environment has no required reviewers. No central builder or TUF runtime file is modified.

Related marketplace handoff: https://github.com/DataDog/marketplace/pull/1696

Investigation and design: https://github.com/DataDog/agent-integrations-tuf/pull/91

Dependencies and rollout

1. Merge Support wheel dispatch from existing release tags integrations-core#24716 first.
2. Re-inventory waiting release runs immediately before merging and cancel every run created from the old approval/tagging workflow. Fresh inventory on 2026-07-29: none waiting.
3. Merge this PR and monitor the first post-tag dispatch through wheel build and TUF publication.

Manual recovery remains available through workflow_dispatch with the signed/tagged SHA and optional explicit package list.

Rollback

Disable the post-tag dispatch call while retaining legacy signing/tagging. Revert the receiver trigger/policy changes only after ensuring no stale old workflow run can create tags.