[rjd15372]

Summary

Wires the two-hop release flow (spec: docs/superpowers/specs/
2026-10-13-prerelease-project-release-flow-design.md) into CI. Follows
#142/#143 (tool side). Nothing in this PR has run against a live OBS yet;
the labs rehearsal runbook is included and is the next step.

• obs-release-pr.yml (new): a release PR (every root/ change under
  root/*/releases/) populates per-instance pre-release OBS projects
  (<pr_rootprj>:pr-N:<product>:releases:<major>) with sync prerelease
  and runs every QA lane of the release mirrors against them. Own
  no-cancel concurrency group (obs-pr-check cancels superseded runs, and a
  cancelled populate would strand a frozen staging). workflow_dispatch
  with a PR number repopulates. resolve enforces release-only, one
  in-flight release PR per major, a non-empty release list and same-repo
  origin (populate runs with production credentials).
• qa-fanout.yml (new, reusable): the former detect/merge/qa jobs of
  obs-pr-check, parameterised by pr_number, qa_types, ref. Check
  runs now read PR / OBS QA / … and Release / OBS QA / ….
• obs-pr-check.yml: release PRs gated out; QA via the reusable workflow
  after build (discovery no longer overlaps the build poll).
• obs-pr-cleanup.yml: one tag per changed release.yaml, ONE dispatch of
  obs-release.yml with pr_number + tags (only tags created here or
  already at the merge commit); no sync-main lock; the merged release PR's
  project tree is kept (it is the pre-release).
• obs-release.yml: validate → sync release <project> --from <pre-release> per instance (own group) → GitHub releases, or a loud
  failure that keeps the pre-release → delete the pre-release per instance.
• sync-main.yml: the release-only push skip is gone.
• obs-stale-cleanup.yml: skips release-only PRs.
• Tool: sync prerelease applies mirror meta with branch-root redirection
  and no branch fallbacks (branch_fallbacks=False), the record check
  includes _shared/ link targets, inherited config layers and the
  major's release.yaml, and the synced-commit lookup keys on the sync
  job's conclusion per instance instead of the whole run.
• post_pr_comment.py: pre-release comment mode (tested renderer).
• project release bakes EXPECTED_VERSIONS into every mirror qa: entry
  at cut time (same rules as qa show on staging; verified identical on the
  real staging:18 tree incl. containers/extras/tarballs), so release QA on
  the pre-release, which has no package directories, gets the parameter it
  requires. An entry that sets it by hand keeps its value.
• Docs: tool reference, copilot-instructions Workflows 1-8, READMEs,
  spec §3-§5 corrected; rehearsal runbook at
  docs/superpowers/specs/2026-10-14-prerelease-rehearsal-runbook.md.

Known limits (documented)

• GitHub keeps one pending run per concurrency group: a populate queued
  behind a sync-main upload, or back-to-back hop-2 dispatches, can be
  displaced; recovery is a re-dispatch (idempotent).
• A merged release PR that creates no new tag, or a populate that starts
  after the PR closed, leaves a pre-release to delete by hand.

Testing

640 tests, black, pyright 0 errors, actionlint 1.7.7 clean on every
workflow. Live validation = the rehearsal runbook on labs.

[rjd15372]

Added b37c1f1: project release now bakes EXPECTED_VERSIONS into every mirror qa: entry at cut time (same rules as qa show on staging; verified identical on the real staging:18 tree incl. containers/extras/tarballs), so release QA on the pre-release gets the parameter it requires. The runbook item is now a check, not a limitation.