ci/build-one: accept arbitrary commit input; publish to nightly-bisect-* tag

[widgetii]

Summary

PR-E of six. Tiny CI-only change: build-one.yml gains an optional commit workflow_dispatch input. With it, git bisect run can drive sub-nightly granularity rebuilds when daily resolution isn't enough.

What changes

• New optional input commit: (SHA). When set, checkout pulls that ref.
• New resolve job computes the upload tag once and threads it via job outputs:
  • With commit: nightly-bisect-<short> (deterministic per commit, prerelease)
  • Without commit: nightly-bisect-<short>-<UTC ts> (so repeated one-offs of the same HEAD don't collide)
• Upload becomes prerelease with a structured body (sha=, short=, platform=, one_off=true).
• Retry budget bumped to match ci/manifest: publish on partial failure; fix built_at=; extend retry budget #2115 (30 60 120 300 600 1200).

Tag namespace separation

nightly-bisect-* is deliberately distinct from nightly-YYYYMMDD-<short> (the dated nightlies produced by build.yml):

• enrich_manifest.py (ci/nightly: manifest aggregator + 90-build retention sweep #2112) filters strictly on ^nightly-[0-9]{8}-[0-9a-f]{7}$, so nightly-bisect-* releases never enter manifest.{json,flat}.
• cleanup.yml (ci/nightly: manifest aggregator + 90-build retention sweep #2112) uses the same regex, so the 90-build retention sweep leaves them alone. One-off bisect builds persist until you delete them manually.

This means sysupgrade --build=nightly-bisect-<short> won't resolve via the manifest path (correct — these aren't channel-published builds), but sysupgrade --url=<github asset url> works as always.

Use it

# Single platform, single commit
gh workflow run build-one.yml -f platform=hi3520dv200_lite -f commit=<sha>

# git bisect run example (will be wrapped by upcoming PR-D's openipc-bisect)
git bisect start <bad-sha> <good-sha>
git bisect run sh -c '
  gh workflow run build-one.yml -f platform=hi3520dv200_lite -f commit=$(git rev-parse HEAD) &&
  gh run watch $(gh run list -L1 -w build-one.yml --json databaseId -q .[0].databaseId)
'

Test plan

• CI passes on this PR.
• After merge, dispatch with platform=hi3520dv200_lite and no commit → builds HEAD, publishes to nightly-bisect-<short>-<ts>.
• Dispatch with platform=hi3520dv200_lite -f commit=<earlier sha> → builds that ref, publishes to nightly-bisect-<short> (deterministic).
• Verify the dated nightly index on gh-pages is unchanged (no nightly-bisect-* entries in manifest.flat).

🤖 Generated with Claude Code