chore(deps): bump OMT-Global/bootstrap/.github/workflows/release-preflight-reusable.yml from 05296606785553deb8f36e4f18313076dfc9646d to 9a9e4e82e66fceeaa91aacf3325bad220b9693e5

[dependabot]

Bumps OMT-Global/bootstrap/.github/workflows/release-preflight-reusable.yml from 0529660 to 9a9e4e8.

Changelog

Sourced from OMT-Global/bootstrap/.github/workflows/release-preflight-reusable.yml's changelog.

Governed Release Train

This repository uses release maturity level governed.

Manual Flow

1. Open a release train issue with .github/ISSUE_TEMPLATE/release_train.yml.
2. Create or update the release/{major}.{minor} release branch.
3. Run Release Preflight with the candidate version, channel, target ref, and release issue.
4. Copy the successful preflight run ID into the release issue.
5. Run Full Release Validation against the same target ref.
6. Copy the successful validation run ID into the release issue.
7. Create the exact release tag only after validation evidence exists.
8. Run Release Publish with the tag, preflight run ID, validation run ID, channel, and release issue.
9. Run or review Release Postpublish, then close or supersede the release issue.

Publish must consume the artifact bundle proven by preflight. If the preflight artifact cannot be downloaded or its recorded target SHA differs from the tag SHA, publish must fail instead of rebuilding.

Customization

Repo-specific behavior belongs in these hook scripts:

• scripts/release/prep.sh
• scripts/release/preflight.sh
• scripts/release/validate.sh
• scripts/release/build.sh
• scripts/release/publish.sh
• scripts/release/postpublish.sh

The generated defaults do not require secrets and do not publish external packages.

Commits

• 9a9e4e8 feat: harden public provenance boundaries (#112)
• 36de935 ci: harden Dependabot dependency refreshes (#111)
• 60157b2 feat: strengthen licensing transition contracts (#101)
• b087126 fix: handle empty staged files in pre-commit hook (#95)
• b2a7732 feat: validate public security baseline (#107)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[athena-omt]

Athena review-governance approval on head 1b374c7 (node-local exact-head review).

Verdict: APPROVE.

Change: one line in .github/workflows/release-preflight.yml — bumps the immutable SHA pin for release-preflight-reusable.yml from 0529660 to 9a9e4e82.

Evidence checked:

• New pin 9a9e4e82 resolves and is the current main tip (#112, "harden public provenance boundaries"); old pin 0529660 is a strict ancestor — forward-only bump with no history rewrite risk.
• The reusable workflow exists at both pins; its only inter-pin change is an actions/checkout v4→v4 pin bump (covered by the green "Validate Action Pins" check).
• Call-path compatibility: release-preflight.yml is the sole caller, and all 13 with: inputs it passes (version, channel, target_ref, release_issue, prep_script, preflight_script, build_script, artifact_dir, release_notes_file, tag_prefix, default_branch, evidence_artifact_name, evidence_retention_days) are declared in the reusable's workflow_call.inputs at the new pin. No secrets inheritance is used.
• Branch is fully up to date (head parent == main tip); mergeable: true.
• All 13 check-runs on the exact head are success or conditional-skipped (CI Gate, Fast Checks, attest/verify, Validate Action Pins, Validate Secrets, Verify Dependabot-only Commits all green); no failing commit statuses.
• No unresolved review threads; author and committer are Dependabot/GitHub only.

Residual risk: minimal — release tooling path only, pinned to an attested main commit.