feat(ci): upstream delta detection — auto-PR for new bakeable materials

[gerchowl]

Vision

Automated pipeline that detects new upstream materials, bakes them to the tst HF repo, and presents them for review — without touching the production release tag.

Proposed flow

┌─ scheduled cron (weekly?) ─────────────────────────────────────────┐
│                                                                     │
│  1. snapshot_upstream_catalog.py → upstream-catalog-{date}.json     │
│  2. diff against last known catalog → delta (new material IDs)      │
│  3. if delta is empty → exit clean                                  │
│  4. open PR with:                                                   │
│     - updated upstream catalog snapshot                             │
│     - commit message listing new material IDs per source            │
│  5. dispatch bake.yml for delta materials only (filter_ids input)   │
│     → bakes land on tst HF repo under a staging tag                │
│  6. dispatch derive.yml for new materials (resize + ktx2 + thumb)   │
│  7. dispatch pages.yml → rebuild GH Pages catalog with "new" filter │
│  8. comment on PR: "N new materials baked. Preview: <pages URL>"    │
│                                                                     │
│  PR stays open until maintainer reviews + merges                    │
│  merge triggers: tag update on tst HF repo (metadata/manifest)     │
│  prod cut: separate manual step (existing preflight gates)          │
└─────────────────────────────────────────────────────────────────────┘

What already exists

• scripts/snapshot_upstream_catalog.py — captures upstream IDs (just needs to be run on a schedule)
• bake.yml + derive.yml — filter_ids input (ci(bake): filter-ids workflow input — spot-test specific materials by id (no offset hack) #342) already supports spot-baking specific materials
• scripts/check_substrate_coverage.py — wanted vs actual comparison (ci(validate): release-validate should assert manifest-declared features actually ship (wanted vs. is) #293)
• GH Pages catalog prototype (feat(docs): GH Pages material-catalog gallery — filterable, searchable, with /tst preview #423) — needs filterable/searchable gallery with "new materials" filter
• prod-cut preflight gates (_preflight.py Pre-flight prod-cut gate: enforce tst-prior + tier-parity + maintainer-only deprecation escape hatch #345) — already gate prod pushes behind tst validation

What's missing

1. Delta computation script — diff two upstream catalog snapshots, emit new/removed/changed IDs
2. Cron workflow — scheduled dispatch that runs the delta, opens PR, triggers bakes
3. GH Pages "new materials" filter — catalog page shows materials not yet in the current prod tag
4. PR automation — bot comments with preview links + coverage summary after bake completes
5. Tag management — staging tag on tst HF repo for preview bakes (vs the release tag clients consume)

Key principle

Bake to tst, preview on Pages, accept via PR merge — only then cut to prod.

The PR is the review gate. New materials land on tst HF and are previewable immediately, but the release tag (what clients see) only advances after human acceptance.

Related

• feat(docs): GH Pages material-catalog gallery — filterable, searchable, with /tst preview #423 — GH Pages catalog prototype (needs filter capability)
• ci(validate): release-validate should assert manifest-declared features actually ship (wanted vs. is) #293 — substrate coverage checker (provides the validation backbone)
• ci(bake): filter-ids workflow input — spot-test specific materials by id (no offset hack) #342 — filter_ids bake input (spot-baking specific materials)
• ops: re-bake prod substrate to clear v2026.04.2 stale gpuopen catalog (resolves mat-vis#285) #376 — re-bake prod substrate (the manual prod-cut workflow)