Merge validation-framework branch into main and retire the branch

[hdamker]

Problem description

The validation-framework branch was the staging area for the v1 validation framework rewrite. v1-rc has soaked through the cohort of enabled repositories and is currently stable: cohort dispatch on main of all 16 enabled repos shows the same 5 errors and identical finding totals as the previous baseline, no codeowner-filed validation regressions over the observation window. The branch is now a strict superset of main (238 commits to land, file-level diff is empty in both directions, no main-side drift since the last sync) and is ready to merge.

After the merge, four surfaces hard-pin to the validation-framework branch ref and need to be repointed before the branch is deleted; otherwise they break.

Possible evolution

Steps 1–8 below land in order. The branch must not be deleted before steps 2–6 complete.

1. Open a reverse-merge PR validation-framework → main. Merge with --no-ff to preserve the merge-commit topology so the v1-rc lineage stays visible in git log main.

2. ReleaseTest caller workflows: repoint @validation-framework → @main in .github/workflows/camara-validation.yml and .github/workflows/release-automation.yml on camaraproject/ReleaseTest. ReleaseTest is the canary; pinning to @main (not @v1-rc) preserves the canary semantics of "see new tip changes immediately". Other repositories stay on @v1-rc.

3. Dependabot config: drop the target-branch: validation-framework overrides on entries 2 and 3 of .github/dependabot.yml (they default back to main).

4. Regression workflow triggers: change branches: [validation-framework] to branches: [main] on both .github/workflows/validation-regression.yml and .github/workflows/release-automation-regression.yml.

5. Verification: dispatch a validation run on main and push a no-op change to confirm the regression workflow triggers fire correctly.

6. GitHub App camara-validation: update the App's external_url (currently points at /blob/validation-framework/documentation/README.md) to a /blob/main/... equivalent. Manual change in the App settings panel.

7. Delete the validation-framework branch.

8. (Optional, depending on outcome of Update or retire release_automation/docs/branching-model.md after validation-framework merge #258): update or retire release_automation/docs/branching-model.md.

Steps 3–5 can be a single small PR to tooling/main. Step 2 is a separate PR on ReleaseTest. Step 6 is a manual App-settings change.

Tag handling: @v1-rc does not move at merge time. The lightweight tag continues to point at the current validation-framework HEAD, which becomes a parent of main's new HEAD via the merge commit. Consumers resolving @v1-rc are unaffected. Promotion to @v1 is a separate decision after the central default advisory → enabled flip soaks.

Additional context

• Tracker issues: #484 (progressive rollout), #448 (v1 umbrella).
• Companion issue: Update or retire release_automation/docs/branching-model.md after validation-framework merge #258 (branching-model.md update or retirement).
• Out of scope here: @v1 GA tag promotion, pr_validation v0 removal, any potential v0.4.0 semver release of tooling.

[hdamker]

All cutover steps complete:

1. VF → main merge — Merge validation-framework branch into main #260 merged 2026-05-05
2. ReleaseTest caller workflows repointed @validation-framework → @main — ci: repoint caller workflows from @validation-framework to @main ReleaseTest#147 merged
   3-4. Tooling regression workflows + dependabot retargeted to main — ci: retarget regression workflows and dependabot to main #264 merged
3. Verification — both regression canaries green on post-merge main (validation-regression on a4e175e3, release-automation-regression on e84a1575); end-to-end smoke test on ReleaseTest passed (validation dispatch + /create-snapshot + /discard-snapshot round-trip)
4. GitHub App camara-validation external_url updated to /blob/main/...
5. validation-framework branch deleted

Companion issue #258 addressed by #268 (branching-model.md rewritten for the single-branch model).