epic: fleet orchestration v2 - staged, nightly-gated, selectively-runnable

[joshua-temple]

Restructure the validation fleet to end the concurrent-token transient flakiness, move release cadence onto a green nightly, and add selective single-member runs. Design: ~/llm/plans/cascade/2026-06-26-fleet-orchestration-v2-plan.md (local). Children below; closed as each is verified on a real fleet run.

• Stage the fan-out (4env solo, primary cluster, remainder max-parallel 2) + repos selector
• Nightly-gated rc-cutting and promotion with change-skip and a workflow_dispatch test vector
• New short-path repo proving the repository_dispatch rollback live (closes test(fleet): run the rollback dispatch, dry-run, and deployable-scoped variants live #321)
• Docs: staged, nightly-gated, selective orchestration

[joshua-temple]

Complete. Final staged fleet run (force=true dry_run=true on the nightly-gated release vector) is GREEN across all 11 example repos in one run - primary, artifact-a/b, 4env, 3env, 2env, single-env, release-only, no-env, callbacks, and the new rollback-dispatch - with the dry-run-never-publishes invariant holding (no final v0.6.0 release).

Delivered: staged fan-out (sequenced lanes, peak concurrency ~2, 4env isolated, remainder max-parallel 2); the repos selector for single-member dev runs with the full_run guard blocking selective-run promotion; the nightly-gated, change-skipping rc/promote path with the force+dry_run dispatch vector (proven on demand); the new cascade-example-rollback-dispatch repo proving the repository_dispatch rollback live (#321); docs (#377); and the pre-v1 setup-cli SHA-pin clearing code-scanning alerts #48-#52 (#383).

The validation also surfaced and fixed: version discovery choking on dryrun tags (#382), the rollback suite's unsound seed-anchored assertion (resolver-anchored now), the PR-gate run-resolution flake (#523/#370), and the lossy orchestrate/external state-writes (#372/#389). Residual current-binary cli_version_sha drop tracked in #390; the example repos are tag-pinned and drift-clean (#391).

[joshua-temple]

Reopening. The force dry_run validation was green (all 11), but the first live nightly (cron 07:55 -> v0.6.0-rc.0 -> fleet) FAILED: primary and rollback-dispatch could not resolve action stablekernel/cascade@v0.6.0-dryrun.2 (Set up job). Cause: the dry-run validation runs pinned the example repos to ephemeral -dryrun tags; the repin ref-rewrite only updates -rc refs, so the -dryrun pins persisted; then the dryrun tags were pruned, breaking the pins. Need: the repin must rewrite ALL version refs (rc and dryrun) and the affected repos must be re-pinned to a valid version, then the live nightly path re-validated green - not just a dry-run.