Report scheduled full-stack failures

[dimavrem22]

Executive Summary

Routes scheduled full-stack failures through one signed, threaded reporting workflow.

• Full stack e2e owns the existing twice-daily schedule and runs the latest-host canary first.
• Only scheduled failure, timed-out, and startup-failure conclusions are reported.
• The completion reporter has read-only Actions permission and never checks out repository code.

Description

Converts the canary into a reusable workflow, invokes it as the first stage of Full stack e2e, and moves the existing schedule to that parent workflow. A separate workflow_run reporter posts the root notification and sends a compact HMAC-SHA256 signed event with stable run, attempt, revision, environment, and thread identifiers.

The plugin version is bumped to 0.2.11 for this release.

Pull requests and manual runs continue to execute the stack but cannot trigger scheduled-failure reporting. Draft and cross-repository pull requests remain skipped.

Reason

Unattended canary and live-stack failures need one durable run identity and one structured completion path so follow-up automation can verify and investigate the exact failed run.

Decisions

• Preserve the current schedule while making canary and live checks one sequential scheduled run.
• Trigger reporting only from a completed Full stack e2e run whose source event was schedule.
• Send the signed event even if the notification step fails.
• Use generic repository secrets for every destination and environment-specific value.

Testing

• Complete Python suite: 549 passed, 23 skipped.
• Scheduled reporting contract test passed.
• YAML parsing passed for all three changed workflow files.
• actionlint passed for all three changed workflow files; the repository's existing queue key warning was excluded.
• git diff --check passed.