ci: sync pilo-cli:latest to main via pilo-evals-judge dispatch

.github/workflows/trigger_main_build.yml

@@ -0,0 +1,59 @@
+name: Trigger Pilo Main Build
+
+# On every push to main (and manual dispatch), tell pilo-evals-judge to build
+# pilo-cli:<sha> and move pilo-cli:latest to it, so scheduled evals always run
+# the current main build. Thin trigger — all build logic lives in
+# pilo-evals-judge's handle_pilo_main_build.yml. Mirrors trigger_eval.yml.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  trigger-main-build:
+    name: Dispatch pilo_main_build to pilo-evals-judge
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve commit timestamp
+        id: meta
+        run: |
+          # head_commit is present on push events but absent on workflow_dispatch;
+          # fall back to the current UTC time so the payload is always populated.
+          TS="${{ github.event.head_commit.timestamp }}"
+          if [ -z "$TS" ]; then TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
+          echo "commit_timestamp=$TS" >> "$GITHUB_OUTPUT"
+
+      - name: Trigger repository_dispatch
+        run: |
+          cat > payload.json <<EOF
+          {
+            "event_type": "pilo_main_build",
+            "client_payload": {
+              "git_sha": "${{ github.sha }}",
+              "git_ref": "${{ github.ref }}",
+              "repo": "${{ github.repository }}",
+              "commit_timestamp": "${{ steps.meta.outputs.commit_timestamp }}",
+              "run_id": "${{ github.run_id }}"
+            }
+          }
+          EOF
+
+          HTTP_STATUS=$(curl -s -o response.json -w "%{http_code}" \
+            -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.PILO_EVALS_DISPATCH_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/Mozilla-Ocho/pilo-evals-judge/dispatches \
+            --data @payload.json)
+
+          echo "GitHub API HTTP status: $HTTP_STATUS"
+          if [[ "$HTTP_STATUS" -lt 200 || "$HTTP_STATUS" -ge 300 ]]; then
+            echo "❌ Failed to send repository_dispatch event (HTTP $HTTP_STATUS)"
+            [ -s response.json ] && cat response.json
+            exit 1
+          fi
+          echo "✓ Dispatched pilo_main_build for ${{ github.sha }}"