[consistency C1] Land reusable-promote.yml in projectbluefin/actions

[castrojo]

Tracks consolidation item C1 from consistency-audit.md.

Problem: `promote-testing-to-main.yml` is triplicated across `bluefin` (~14 KB), `bluefin-lts` (~14 KB), and `dakota` (~6 KB) — ~700 lines of YAML that drift independently.

Proposed solution: ship `reusable-promote.yml` as `projectbluefin/actions/.github/workflows/reusable-promote.yml`. Each image repo's promote workflow becomes a ~30-line caller.

Adoption order (canary-first): dakota → bluefin-lts → bluefin (one promotion cycle observation between each).

Rollback strategy: keep original workflow commented in same PR for one full promotion cycle.

Effort: ~1 day (PR to actions/, then 3 small migration PRs gated on the canary).

Parent: #583

[castrojo]

Schema blocker discovered 2026-06-10

Before deploying the reusable-promote.yml template, the schema mismatch between repos needs resolution.

Current release-state.yaml schema (dakota, the only repo with it in place):

# Managed by promote-testing-to-main.yml. Do not edit manually.
testing:
  dakota: "sha256:..."]
  dakota-nvidia: "sha256:..."
updated_at: "2026-..."]

Template proposes (reusable-promote.yml):

promoted_at: "2026-..."
source_branch: testing
variants:
  - name: dakota
    digest: sha256:...
    tag: testing

These schemas are incompatible. execute-release.yml in each image repo reads release-state.yaml — changing the schema breaks execute-release.yml unless both are updated simultaneously.

Required before C1 can land:

1. Decide on canonical schema (new template format is cleaner; existing format works today)
2. If adopting new schema: update execute-release.yml in dakota, bluefin, and bluefin-lts to read new format
3. Create C5 JSON schema (projectbluefin/actions/docs/schemas/release-state.schema.json) based on chosen schema
4. Then deploy reusable-promote.yml in actions + thin callers in image repos

Effort re-estimate: The 1-day estimate holds, but requires coordinated changes across 4 repos (actions + 3 image repos). Consider shipping dakota first as the canary, observe one promotion cycle, then roll out to bluefin-lts and bluefin.

Other remaining template fixes:

• Replace <sha> placeholders: actions/create-github-app-token@bcd2ba... # v3, actions/checkout@df4cb1... # v6
• Add GHCR authentication step before skopeo inspect calls
• Replace yq with jq or python3 (yq not universally available on ubuntu runners)
• Align concurrency group name with per-repo convention