refactor(ci): extract release qualification and serialize Codex reviews

[SDAChess]

Summary

Move tagged-release qualification into a callable workflow so its security, compatibility, and behavioral checks can be reviewed separately from publication. The two Codex reviews are scheduled independently and share a concurrency group that retains pending reviews while preventing overlapping API use across release and manual runs.

Related Issue

No tracking issue, at maintainer request. This is the first PR in the release-workflow stack. #4420 is stacked on this branch and adds separate Release and Pre-release orchestration. Merge this PR first, then retarget #4420 to main.

Changes

• Extract the existing qualification suites, advisory compatibility review, and result aggregation into release-qualification.yml.
• Keep existing test matrices, scanner enforcement settings, result artifacts, and the qualification gate before publication.
• Serialize Codex reviews with queue: max to retain up to 100 pending reviews. Either review can run first; compatibility does not wait for the other security scanners. Its findings and execution failures remain advisory, and the caller waits for it to finish.
• Update CI guidance for the callable workflow and review scheduling.

Testing

• Actionlint, including ShellCheck, reports no other findings for the four affected workflows after locally filtering its unsupported concurrency.queue diagnostic. Unfiltered actionlint 1.7.12 reports two expected findings for GitHub's supported queue: max setting; see Actionlint does not know about queue: key for concurrency rhysd/actionlint#657. Repository lint configuration is unchanged.
• Offline Zizmor reports no high-severity findings for the affected workflows.
• Qualification-summary tests pass.
• Focused comparison verifies unchanged suite settings and publication jobs, shared Codex concurrency with pending-review retention, independent review scheduling, and all 22 skill inventory entries.
• Markdown lint passes for the updated CI guidance.
• git diff --check passes.
• Release workflows were not dispatched; live release publication is not part of this validation.

Checklist

• Follows Conventional Commits.
• Commit is signed off for DCO.
• CI workflow documentation updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4419.docs.buildwithfern.com/openshell

[elezar]

The qualification extraction looks reasonable. Please make the shared Codex concurrency group retain pending reviews before merging: cancel-in-progress: false protects running work but still allows newer reviews to cancel pending ones. I also left a non-blocking suggestion about whether the advisory compatibility review needs to wait for the entire Security Scan workflow.

[SDAChess]

/ok-to-test 7988c45

[elezar]

Failed prerequisite builds now lose qualification evidence (.github/workflows/release-tag.yml:133-135).

Before this PR, when a Debian, RPM, VM-driver, or image build failed, the top-level qualification-result job still ran through if: always(), recorded unsuccessful or skipped suites, and uploaded the qualification summary. With this PR, the caller depends on all those builds and has no condition overriding the implicit success check, so any prerequisite failure skips the entire reusable workflow. The internal if: always() summary job cannot run when its caller is skipped. Maintainers therefore lose the qualification report for failed candidates, and checks that could have run independently are also skipped.

Please preserve qualification summary generation when prerequisite builds fail, while continuing to block publication. This needs failure handling at the caller boundary; the condition on the summary job inside the called workflow is insufficient.

Reviewed at 7988c45ff0532d4f0760b091daf9b6f4bf683e5d. Qualification-summary tests and git diff --check passed; live release scheduling was not tested.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[SDAChess]

/ok-to-test f05c4ed

[elezar]

Reviewed f05c4ed. The caller condition addresses the previously reported loss of qualification evidence after prerequisite build failures. No remaining actionable findings. Branch Checks, Actionlint, and Zizmor pass; live release failure handling remains untested.