ci: sync pilo-cli:latest to main via pilo-evals-judge dispatch

[lmorchard]

Why

The eval pipeline runs pilo-cli:latest, but nothing currently moves that tag on main — trigger_eval.yml only dispatches on evals/** branches, and the eval repo's build path tags by SHA, never :latest. As a result pilo-cli:latest has been frozen at a Feb-2026 build, so the scheduled "pilo-cli" eval line has been measuring stale code rather than current main.

What this does

Adds .github/workflows/trigger_main_build.yml: a thin trigger that, on every push to main (plus workflow_dispatch), fires a pilo_main_build repository_dispatch to Mozilla-Ocho/pilo-evals-judge. All build logic lives there — this just signals the SHA. Mirrors the existing trigger_eval.yml (same PILO_EVALS_DISPATCH_TOKEN secret, endpoint, and API version).

Companion PR

Consumer side: Mozilla-Ocho/pilo-evals-judge#87 (handle_pilo_main_build.yml builds pilo-cli:<sha> and moves :latest). That PR should merge first; once this one merges, :latest begins tracking main on every push.

Test plan

• YAML parse + convention cross-check against trigger_eval.yml (secret, endpoint, X-GitHub-Api-Version)
• After both PRs merge: trigger via workflow_dispatch, confirm the eval repo's Handle Pilo Main Build run fires and pilo-cli:latest advances to current main.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to keep the pilo-cli:latest image tracking main by dispatching a repository_dispatch event to Mozilla-Ocho/pilo-evals-judge on every push to main (and via manual trigger), so scheduled evals run against the current main build rather than a stale image.

Changes:

• Introduces a new trigger_main_build.yml workflow that fires a pilo_main_build repository_dispatch to Mozilla-Ocho/pilo-evals-judge.
• Includes a small metadata step to populate the dispatch payload with a commit timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.