feat: auto-sync add-on pins to upstream FTW releases and publish beta

[HuggeK]

What this does

Makes the FTW Home Assistant add-on update itself when a new FTW version is
released upstream and get packaged on the beta channel — no hand-editing of
pins. Today every release is manually dispatched and every upstream digest is
pinned by hand in compatibility.yaml; this closes that loop while keeping the
existing fail-closed release gates as the only path to a published artifact.

The flow

srcfl/ftw release ──▶ Sync upstream FTW ──▶ PR ──▶ checks ──▶ merge to main
                                                                    │
                                                                    ▼
                                                          Auto publish beta
                                                                    │
                                                                    ▼
                                                Publish beta (existing, signed)

1. Sync upstream FTW (.github/workflows/sync-upstream.yml) — runs
   hourly, on repository_dispatch: ftw-release, or manually. It runs
   scripts/upstream_sync.py, which picks the highest published upstream
   Core/Optimizer release, resolves the multi-arch digest and source commit
   from the registry, and rewrites compatibility.yaml, ftw/config.yaml,
   ftw/CHANGELOG.md, and a fresh blocked pilot record. It then validates,
   runs the test suite, opens a PR, runs check.yml on the branch, merges when
   checks pass, and nudges publication.
2. Auto publish beta (.github/workflows/auto-publish-beta.yml) — on the
   push to main, dispatches the existing release-beta.yml only when
   config.yaml still carries the pending beta marker, guarding against
   already-existing tags/releases and active runs.

Why it's still safe

The automation holds no packages: write and never builds, pushes, or
retags an image. It only produces a human-reviewed PR and, after merge,
dispatches the existing signed release-beta.yml, which independently
re-verifies the version match, publisher marker, source-on-main, cosign
signatures, and SBOMs. The fail-closed gates remain the only way to ship.

Design details & guarantees

• Forward-only: upstream_sync.py never downgrades and skips upstream
  releases whose multi-arch image is not fully published yet (ImageNotReady
  → retry on the next schedule tick).
• Label re-check: before pinning, it asserts the image's
  org.opencontainers.image.version / .revision labels match the release, so
  it can't pin a mislabeled or half-published image.
• HA qualification stays blocked: each sync writes a blocked pilot record
  and resets home_assistant_os_supervisor to blocked +
  promoted_from_beta to nulls, so nothing is auto-promoted to stable.
• Idempotent versioning: the add-on beta number is bumped past any tag that
  already exists.
• Layered triggers: Auto publish beta fires on the merge push and on a
  schedule fallback, so a missed dispatch still self-heals.
• Optional upstream hook: srcfl/ftw can send repository_dispatch type
  ftw-release for instant syncs; the hourly cron is the fallback if it
  doesn't.

Tests

python -m unittest discover -s tests → 113 passing. Adds
tests/test_upstream_sync.py (version ordering, release selection, next-version
logic, file rewrites, and a compose→YAML round-trip asserted against the real
validators) and tests/test_automation_workflows.py (structure assertions that
the workflows can't write packages or build/push images). Generalizes the
version-coupled tests in test_validate.py / test_release_gate.py so future
automated bumps don't break the suite.

🤖 Generated with Claude Code