CI: wire .pfnci test stage to GHA-built wheels - #10058

Adds a pull_request trigger + a matching guard case so pushes to a PR
against main/v* auto-fire the GHA wheel build. Fork PRs have no access
to secrets on pull_request events, so dispatch-flexci is gated off and
treated as expected-skipped by the checks job.

Purpose: let us push commits to leofang:ci/wire-pfnci-wheels to verify
wheel build succeeds, then /test mini on the PR uses main's flexci.yml
to dispatch FlexCI with secrets and fetch the wheels built by this
trigger.

REVERT this commit before merging PR cupy#10058 into main.

Refs: cupy#9794, cupy#9974

…y#9794, cupy#9974)

Folds the FlexCI dispatch (formerly flexci.yml) into ci.yml so the whole
build+dispatch pipeline sits behind a single guard:

- Triggers reduced to issue_comment + pull_request_target(closed).
  Auto-build on pull_request open/push is dropped: except for pre-flight
  checks (pretest.yml etc.), PR updates do not start wheel builds.
- guard job: on issue_comment, requires a PR comment starting with /test
  from an OWNER/MEMBER and resolves the PR merge ref; on
  pull_request_target, requires merged && no skip-ci label and resolves
  the merge_commit_sha.
- guard also resolves artifact_sha -- the SHA keying the wheel artifact
  names the test stage looks up: the PR head SHA for /test runs
  (recoverable on the FlexCI side as HEAD, or HEAD^2 of a merge
  checkout), or the merge commit SHA for post-merge runs. build-wheel.yml
  gains an artifact-sha input and names artifacts with it instead of
  github.sha, which is the default-branch tip for issue_comment events
  and the transient merge SHA for pull_request events -- neither
  reconstructible from the FlexCI side.
- dispatch-flexci (lifted from flexci.yml: same dual trusted/untrusted
  checkout, same dispatcher invocation) now needs the build jobs, so
  FlexCI only starts once the artifacts it will fetch exist.

The .pfnci side that consumes these artifacts lands in cupy#10058.

Adds a pull_request trigger + matching guard case so pushes to PRs
against main/v* auto-fire the wheel-build side, letting this PR (and
cupy#10058 stacked on it) validate the build pipeline before ci.yml is on
the default branch. Fork PRs get no secrets on pull_request events, so
dispatch-flexci is gated off and the checks job treats it as
expected-skipped.

REVERT this commit before merging this PR.

…on push

Two defenses against pushes racing the /test flow (third review round):

- flexci.yml refuses to dispatch when the PR no longer points at the
  revision the completed build tested: the dispatcher resolves the
  PR's current head at dispatch time, so a push landing during the
  build window could otherwise ride the earlier /test vouch into
  FlexCI (and, as of cupy#10058, pair that head's FlexCI run with the
  older head's wheels). The untrusted config.tags.json checkout is
  likewise pinned to the tested revision instead of the live merge
  ref. Residual race: the seconds between this check and the
  dispatcher's own lookup -- the same window the pre-split flexci.yml
  always had.

- A push (synchronize) now cancels any in-flight labeled build and
  clears a stale ci:triggered label, so the label's presence keeps
  meaning "the current head was vouched". The cancellation is free:
  synchronize runs enter the same CI-<pr>-pull_request concurrency
  group as the labeled build, and cancel-in-progress evicts it; the
  guard makes those runs no-ops otherwise. The label removal lives on
  the pull_request_target synchronize leg, because fork-PR
  pull_request runs hold a read-only GITHUB_TOKEN; that leg executes
  base-branch workflow code with a writable token and checks out no
  PR code. Label removal with GITHUB_TOKEN fires no workflow, so
  there is no recursion.

…kflows

Replaces the previous single-workflow orchestration (reviewed over five
design rounds; see PR discussion) with three workflows, each with a
one-sentence story:

  ci-trigger.yml  Turns /test comments from an OWNER/MEMBER into
                  ci:triggered label events, and keeps the label honest
                  on pushes/reopens.
  ci.yml          Builds wheels when a PR is vouched (labeled) or when a
                  merge lands (push); the push leg also dispatches
                  FlexCI in-run.
  flexci.yml      After a successful /test build run, dispatches FlexCI
                  with the recorded request.

Design bar: as safe as the old flexci.yml with the same UX -- not
safer -- except that the new wheel build stage's shared compile cache
must not be poisonable by vouched PR code, which is the single
requirement forcing /test builds into PR-scoped cache context.

/test flow: the trigger leg validates the comment (PR open, OWNER or
MEMBER, explicit target), records the raw event payload as a
dispatch-request-<pr>-<head_sha> artifact, and bounces the ci:triggered
label with a GitHub App token (GITHUB_TOKEN label events do not trigger
workflows). The labeled build runs in the PR's cache scope (writes
isolated per PR, restores fall back to base/default scope -- since
GitHub's 2026-06-26 change, untrusted default-scope contexts are cache
read-only anyway) from the event-pinned merge commit, tags its wheel
artifacts with the PR number (same-head PRs against different bases
never share wheels), and uploads a build sentinel only when every build
succeeded. flexci.yml reacts to the run's completion: sentinel =
liveness (no-op label runs can never dispatch); PR identity comes only
from trusted API metadata (pulls?head=<head repo>:<branch>); per
candidate PR it requires a request recorded by a default-branch run of
this repository (fork runs cannot forge that provenance), and verifies
the PR still points at the tested head and base before feeding the
recorded payload to flexci_dispatcher.py unchanged.

Post-merge: push events (main, v*, hotfix-*) are trusted, carry
secrets, may write this branch's cache scope, and are the dispatcher's
native input -- so build and dispatch live in one run with plain needs:
ordering, no artifacts, no relay. The guard maps the pushed commit to
its merged PR to honor skip-ci, and skips branch deletions. Push runs
have no shared concurrency group: a burst of merges must not cancel
intermediate runs, each of which carries its own dispatch.

A push to a PR (synchronize) cancels any in-flight labeled build via
the shared ci-build-<PR> concurrency group and clears the stale label;
adding an existing label fires no event, so the bounce removes it
first. All artifact uploads set overwrite so "re-run all jobs" stays
viable across immutable v4+ artifact attempts.

TEMPORARY: flexci.yml carries a legacy pull_request_target(closed)
dispatch job for bases not yet backported the new push workflow
(allowlist, currently v14); each allowlist entry is removed by the same
PR that backports the workflows to that base.

The reusable build workflow no longer receives secrets: it needs none,
and labeled runs of same-repo PRs would otherwise expose repository
secrets to PR code.

Requires (already provisioned or requested): the ci:triggered label;
GitHub App cupy-ci-trigger (Issues:R/W, webhook off) with repository
variable CI_TRIGGER_APP_ID and secret CI_TRIGGER_APP_PRIVATE_KEY;
secrets.FLEXCI_WEBHOOK_SECRET; CUPY_CI_GITHUB_TOKEN on the FlexCI side.
The .pfnci wheel fetch (PR cupy#10058) must pin artifact producers and use
the PR-tagged names; the v14 backport of these workflows lands in
lockstep with this PR's merge.

…kflows

Replaces the previous single-workflow orchestration (reviewed over five
design rounds; see PR discussion) with three workflows, each with a
one-sentence story:

  ci-trigger.yml  Turns /test comments from an OWNER/MEMBER into
                  ci:triggered label events, and keeps the label honest
                  on pushes/reopens.
  ci.yml          Builds wheels when a PR is vouched (labeled) or when a
                  merge lands (push); the push leg also dispatches
                  FlexCI in-run.
  flexci.yml      After a successful /test build run, dispatches FlexCI
                  with the recorded request.

Design bar: as safe as the old flexci.yml with the same UX -- not
safer -- except that the new wheel build stage's shared compile cache
must not be poisonable by vouched PR code, which is the single
requirement forcing /test builds into PR-scoped cache context.

/test flow: the trigger leg validates the comment (PR open, OWNER or
MEMBER, explicit target), records the raw event payload as a
dispatch-request-<pr>-<head_sha> artifact, and bounces the ci:triggered
label with a GitHub App token (GITHUB_TOKEN label events do not trigger
workflows). The labeled build runs in the PR's cache scope (writes
isolated per PR, restores fall back to base/default scope -- since
GitHub's 2026-06-26 change, untrusted default-scope contexts are cache
read-only anyway) from the event-pinned merge commit, tags its wheel
artifacts with the PR number (same-head PRs against different bases
never share wheels), and uploads a build sentinel only when every build
succeeded. flexci.yml reacts to the run's completion: sentinel =
liveness (no-op label runs can never dispatch); PR identity comes only
from trusted API metadata (pulls?head=<head repo>:<branch>); per
candidate PR it requires a request recorded by a default-branch run of
this repository (fork runs cannot forge that provenance), and verifies
the PR still points at the tested head and base before feeding the
recorded payload to flexci_dispatcher.py unchanged.

Post-merge: push events (main, v*, hotfix-*) are trusted, carry
secrets, may write this branch's cache scope, and are the dispatcher's
native input -- so build and dispatch live in one run with plain needs:
ordering, no artifacts, no relay. The guard maps the pushed commit to
its merged PR to honor skip-ci, and skips branch deletions. Push runs
have no shared concurrency group: a burst of merges must not cancel
intermediate runs, each of which carries its own dispatch.

A push to a PR (synchronize) cancels any in-flight labeled build via
the shared ci-build-<PR> concurrency group and clears the stale label;
adding an existing label fires no event, so the bounce removes it
first. All artifact uploads set overwrite so "re-run all jobs" stays
viable across immutable v4+ artifact attempts.

TEMPORARY: flexci.yml carries a legacy pull_request_target(closed)
dispatch job for bases not yet backported the new push workflow
(allowlist, currently v14); each allowlist entry is removed by the same
PR that backports the workflows to that base.

The reusable build workflow no longer receives secrets: it needs none,
and labeled runs of same-repo PRs would otherwise expose repository
secrets to PR code.

Requires (already provisioned or requested): the ci:triggered label;
GitHub App cupy-ci-trigger (Issues:R/W, webhook off) with repository
variable CI_TRIGGER_APP_ID and secret CI_TRIGGER_APP_PRIVATE_KEY;
secrets.FLEXCI_WEBHOOK_SECRET; CUPY_CI_GITHUB_TOKEN on the FlexCI side.
The .pfnci wheel fetch (PR cupy#10058) must pin artifact producers and use
the PR-tagged names; the v14 backport of these workflows lands in
lockstep with this PR's merge.

CI: wire .pfnci test stage to GHA-built wheels

CI: PFN/FlexCI follow-ups on top of #10058

CI: PFN/FlexCI follow-ups on top of #10058

…wups

[backport] CI: PFN/FlexCI follow-ups on top of #10058

CI: wire .pfnci test stage to GHA-built wheels

CI: PFN/FlexCI follow-ups on top of cupy#10058