nix-forge CI v2.12.0

Nix Forge CI v2.12.0

Changelog

• Add explicit package-source start and completion notifications using the
  existing repository token and narrowly scoped callback jobs. Validate actual
  producer identity and run attempt before deriving its source head or activity.
• Invalidate all previous required source results and admission when a rerun
  starts. Completion waits for its producer, revalidates current attempts and
  preserves actual failed-job links. Verified obsolete callbacks make no writes;
  tampered producer metadata and future attempts remain errors.
• After publishing complete queue success, wait at most 55 seconds for GitHub's
  asynchronous merge to expose the next verified front ref, then dispatch its
  missing validation once. Empty queues return quietly. Running, failed or
  incomplete candidates do not start this additional poll.

Existing queue callbacks retain their original payload. Opted-in package
callers declare optional source_run_attempt and source_activity reconciler
dispatch inputs and forward them to source-run-attempt and source-activity.
Use source-activity: in_progress in a source-only start callback, then
source-activity: completed after all source validation jobs. Retain the queue
completion callback name and restrict callbacks to their approved ref namespaces.
Update source branches only after the new caller workflow contract is merged.

No token permissions, required job gates, signing trust or release-builder pins
change. Full expected-head PR and merge-group validation remains required.
The 161 repository regression tests and offline workflow/security checks passed
locally; required hosted validation must pass before publishing this release.
Coverage includes actual callback payloads, immutable producer identity,
completion races, obsolete notifications, 16-job source invalidation, request
budgets and asynchronous next-candidate dispatch.

The source implementation was reviewed at
8cc10aa7a626997ef82bb46b6c3e91e0544869ef. The signed tag and verified release
manifest identify the protected source commit including these notes. Publication
uses the separately pinned SLSA source builder and verifies archive checksums,
all provenance subjects and protected-main ancestry. Restore the v2.11.0 pin and
remove the optional source notification inputs to roll back. Compatible v2.x
consumers have no scheduled support end date.