feat(ci): dispatch wire-tools-ts updates on stable releases + update-wireio-deps + release-flow hardening

[jglanz]

What

Companion to Wire-Network/wire-tools-ts#90 — merge that one first (its repository_dispatch trigger must exist on the consumer's default branch before this producer can dispatch to it).

1. Release dispatch leg (tag-release.yaml) — the tag job exports dist_tag + version; a new dispatch-wire-tools-ts-update job (stable releases only, permissions: {}, runs after publish/tag/release so a failure cannot touch the release) mints a 1-hour wire-release-bot installation token downscoped to repositories: wire-tools-ts + permission-contents: write and fires the wire-libraries-ts-release repository_dispatch. Dispatch-API-only — never git; this is the App's ONE sanctioned use per the never-use-wire-release-bot manifest rule.

2. Release-flow hardening — prepare-release refuses to run while a bot-authored release/prep-v* PR is open (constant concurrency group closes the concurrent-dispatch race; same-repo + bot-author filter keeps fork PRs from blocking releases); tag-release auto-triggers when a release-prep PR is merged by a human (workflow_dispatch stays as the manual/recovery path; the release Environment's required reviewers remain gate 2).

3. scripts/update-wireio-deps.mjs + manual update-wireio-deps.yaml — byte-identical copy of the wire-tools-ts script (dynamic **/package.json scan, per-package npm latest, operators preserved — the exact outpost-*-artifacts pins stay exact, resolutions covered, workspace:* untouched); the workflow differs from the wire-tools-ts one ONLY in its trigger block (manual workflow_dispatch, no repository_dispatch). zx added to root devDependencies for the script.

4. Dependency policy — minimumReleaseAge/minimumReleaseAgeExclude dropped (platform-wide policy; this was the only occurrence). The ten remaining pnpm-workspace.yaml overrides moved into root package.json resolutions beside the @aws-sdk pins — one pinning mechanism, in one place; pnpm-workspace.yaml now declares workspace packages only.

Validation

• --dry-run here: exit 2, opp-typescript-models ^1.0.26 → ^1.0.48 (2 declarations); outpost-{ethereum,solana}-artifacts discovered dynamically and left untouched (npm latest IS the pinned 0.3.0). Write mode touched only @wireio/* version substrings; tree restored (the version bumps ship via this workflow's own PR, not this one).
• actionlint clean on all three workflows; lint + build + jest (7 projects) green via the pre-commit gate on every commit.
• Lockfile effective-overrides verified identical after the resolutions migration (pnpm merges top-level resolutions exactly like overrides); pnpm-lock.yaml deliberately untouched — the next release-prep run refreshes it in CI.

Org configuration (already applied)

• wire-release-bot installation extended to wire-tools-ts (mint would 422 otherwise).
• release environments in BOTH repos now carry required reviewers (jglanz + bearcubsvet) — gate 2 for the auto-trigger. Never add a deployment branch policy to these environments: auto-triggered runs carry refs/pull/<n>/merge, which a branch policy rejects.

🤖 Generated with Claude Code