[GH-04] Add reusable CI, dependency, secret, provenance, and release workflows

[jaavid]

Background

CoreLink is managed as one product across multiple implementation boundaries. This work is owned by .github under EPIC-08.

Problem

The organization does not yet have verified, consistently maintained evidence for this outcome: Add reusable CI, dependency, secret, provenance, and release workflows.

Goal

Add reusable CI, dependency, secret, provenance, and release workflows and make the result the authoritative, reviewable baseline for all affected repositories.

Parent

• Primary Product Epic: EPIC-08
• Backlog ID: GH-04

Scope

• Deliver the stated outcome in .github.
• Reconcile affected organization policy, product claims, ownership, security, release, documentation and repository maturity.
• Retain acceptance evidence for the Beta gate.

Out of Scope

• Runtime feature implementation in this Issue.
• Duplicating the product roadmap in repository README files.
• Presenting scaffolds or planned capability as a supported release.

Acceptance Criteria

• The outcome is documented or configured in its authoritative location.
• Affected repositories link to the source of truth instead of copying it.
• Ownership, review and exception paths are explicit.
• Security, license, privacy and release impacts are addressed where applicable.
• The result is validated against at least one real repository workflow.
• Acceptance evidence is linked and the parent Epic is updated.

Technical Notes

Use organization-wide defaults where inheritance is reliable. Repository-specific exceptions must be minimal and documented. Product maturity claims must distinguish Scaffold, Experimental, Alpha, Beta, Stable and Deprecated.

Dependencies

• Blocked by: [GH-02] Establish team-based CODEOWNERS and protected review rules #3 and repository release needs
• Blocks: Resolved during refinement.
• Cross-repository: Link concrete affected Issues; do not duplicate implementation.

Planning Metadata

• Type: Technical Task
• Priority: P0
• Product milestone: Beta
• Domains: deployment, security
• Area: infra
• Complexity: M
• Initial status: Triage
• DRI: Unassigned
• Intended labels: type:technical-task, priority:p0, domain:deployment, domain:security, area:infra

Definition of Done

• Acceptance criteria demonstrated.
• Required reviews and retained evidence pass.
• Organization and repository links are updated.
• Security and policy implications are reviewed.
• Documentation and release notes are updated where applicable.
• Pull request or configuration change is linked.