[WoA] Automate public cross-repository dispatch

[isVoid]

Description

Tracks https://github.com/NVIDIA-dev/cuda-python-private/issues/584.

This is public PR B of the four-PR WoA cross-repository CI rollout, stacked on public PR A (#3025). It adds the automatic public-side control plane:

• selection of an exact successful public main CI run with successful WoA producers and the complete digest-bearing artifact allowlist;
• an App-owned Check Run ledger, three-commit batching, two-hour scheduled flush, bootstrap behavior, and exact-attempt deduplication;
• isolated dispatch through the private Actions-only GitHub App; and
• a cancellation broker that resolves the exact correlated private validation before dispatching the bounded private cancellation controller.

The selector checks out only trusted main. Jobs holding the private-dispatch App token perform no checkout or artifact processing. The canonical WoA check remains informational and non-required in phase 1.

Draft gates

• Merge and exercise both foundation PRs first.
• Complete batch threshold, delayed flush, duplicate, retry, and bootstrap acceptance tests.
• Exercise cancellation before dispatch, while queued/running, and after completion.
• Observe the initial pilot before changing any ruleset or release policy.

Validation

• actionlint, Python byte-compilation, YAML parsing, and git diff --check pass.
• Targeted selector unit smoke covers artifact selection, batch threshold, and exact-attempt deduplication.
• Live read-only selection resolved run 37333876562, its exact three artifacts, and the expected initial bootstrap decision.

Checklist

• New or existing tests cover these changes where they can run before merge.
• The design document is up to date with these changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.