fix: preserve caller lifecycle context in reusable drift checks

[Pigbibi]

Summary

• pass the caller lifecycle bucket into the reusable workflow explicitly
• pin QPK checkout through a caller-supplied ref
• route drift issues back to the caller repository

Validation

• python3 -m pytest -q tests/test_reusable_drift_workflow.py
• actionlint .github/workflows/reusable-drift-check.yml

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae0c9d7fdd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the default checkout pinned to the called workflow

When a caller pins this reusable workflow by SHA or tag but does not pass the new optional quant_platform_kit_ref, this default makes the job install whatever QuantPlatformKit code is on main instead of the workflow version the caller invoked. That reintroduces a moving dependency for scheduled drift checks and can break previously pinned callers when main later changes incompatibly; the fallback should stay tied to the called workflow SHA/ref or the input should be required.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Default drift issues to the caller repo

In runs where a caller does not pass the new optional drift_issue_repository, this default still directs gh issue create at QuantStrategyLab/AuditOrchestrator while the workflow uses the caller repository's GITHUB_TOKEN. That either sends drift alerts to the wrong tracker or fails when the caller token cannot write to the orchestrator repo; the default path should derive the repository from the caller context unless an override is explicitly supplied.

Useful? React with 👍 / 👎.