[GH-04] Add reusable CI, dependency, secret, provenance, and release workflows

[jaavid]

Background

CoreLink is managed as one product across multiple implementation boundaries. This work is owned by .github under EPIC-08.

Problem

The organization does not yet have verified, consistently maintained evidence for this outcome: Add reusable CI, dependency, secret, provenance, and release workflows.

Goal

Add reusable CI, dependency, secret, provenance, and release workflows and make the result the authoritative, reviewable baseline for all affected repositories.

Parent

• Primary Product Epic: EPIC-08
• Backlog ID: GH-04

Scope

• Deliver the stated outcome in .github.
• Reconcile affected organization policy, product claims, ownership, security, release, documentation and repository maturity.
• Retain acceptance evidence for the Beta gate.

Out of Scope

• Runtime feature implementation in this Issue.
• Duplicating the product roadmap in repository README files.
• Presenting scaffolds or planned capability as a supported release.

Acceptance Criteria

• The outcome is documented or configured in its authoritative location.
• Affected repositories link to the source of truth instead of copying it.
• Ownership, review and exception paths are explicit.
• Security, license, privacy and release impacts are addressed where applicable.
• The result is validated against at least one real repository workflow.
• Acceptance evidence is linked and the parent Epic is updated.

Technical Notes

Use organization-wide defaults where inheritance is reliable. Repository-specific exceptions must be minimal and documented. Product maturity claims must distinguish Scaffold, Experimental, Alpha, Beta, Stable and Deprecated.

Dependencies

• Active prerequisite: GH-03 for approved security/license/release/support policy boundaries.
• Execution input: concrete release needs from active repositories; reusable workflows should be driven by real adoption rather than speculative coverage.
• Blocks: release/provenance standardization, CLI-03, and EPIC-08 release-governance acceptance.
• Cross-repository: Link concrete affected Issues; do not duplicate implementation.
• Current dependency state: See the CoreLink Product organization Project.

Planning Metadata

• Type: Technical Task
• Priority snapshot: P0
• Product milestone snapshot: Beta
• Domains snapshot: deployment, security
• Area snapshot: infra
• Complexity: M
• Created in status: Triage
• Current status and DRI: See the CoreLink Product organization Project.
• Intended repository labels: type:technical-task

Definition of Done

• Acceptance criteria demonstrated.
• Required reviews and retained evidence pass.
• Organization and repository links are updated.
• Security and policy implications are reviewed.
• Documentation and release notes are updated where applicable.
• Pull request or configuration change is linked.