feat: GHA artifact passing between build jobs within one orchestrate run

[joshua-temple]

Problem

The publish callback addresses artifact metadata (artifact_id = immutable registry reference). But there is no way to pass GHA artifacts (actions/upload-artifact / actions/download-artifact) between build jobs within the same orchestrate run.

Use cases:

• Build job A compiles + uploads a binary artifact; Build job B downloads and signs it; Deploy job C downloads the signed binary
• Build job produces a Helm chart; Deploy job downloads and pushes to registry
• Compile + unit test → integration test → package (sequential build pipeline within one orchestrate)

Proposed approach

Add an artifact: field to builds that declares what the job uploads and what downstream builds/deploys should download before running:

ci:
  config:
    builds:
      - name: compile
        workflow: .github/workflows/compile.yaml
        artifact:
          upload: dist/  # What compile uploads (via upload-artifact)

      - name: sign
        workflow: .github/workflows/sign.yaml
        depends_on: [compile]
        artifact:
          download: dist/  # What sign downloads before running
          upload: dist-signed/

The generator would emit upload-artifact / download-artifact steps in the appropriate jobs.

Impact

Medium — multi-stage build pipelines. Without this, each stage needs its own registry/storage workaround.