[Phase 3] Cross-repo rollout: lift the all-reusables standard into petry-projects/.github and repin downstream consumers

[github-actions]

Story

As a org maintainer,
I want promote the all-reusables tag-pinning standard into petry-projects/.github and repin downstream consuming repos that call first-party reusables by SHA/# main,
so that the standard and its compliance gate apply org-wide, not just inside .github-private.

Acceptance Criteria

1. The generalized pinning standard (one convention for all first-party reusables) is reflected in petry-projects/.github (org AGENTS.md / standards/) so downstream repos defer to it, as foreseen by the AGENTS.md 'Promotion' note.
2. Downstream consumer repos that call first-party reusables (e.g. ci-failure-analyst template deployments) are repinned from SHA/# main to the channel tag.
3. The compliance check (story id 3) is available to / referenced by downstream repos so off-channel pins are caught org-wide.
4. A rollout/migration order is recorded that avoids breaking in-flight consumers (dogfood .github-private first, then rings).

Tasks / Subtasks

• Lift the standard into petry-projects/.github. (AC: test issue from agent #1)
  • Generalize the org AGENTS.md / standards text from dev-lead/pr-review to all first-party reusables; cross-link this repo's versioning.md.
• Inventory and repin downstream consumers. (AC: Go-live improvements for PR review agent #2, Optimize review: small-PR and incremental fast paths #4)
  • Enumerate repos deploying templates/ci-failure-analyst.yml and other first-party reusable callers; repin to channel tags ring-by-ring.
• Make the compliance gate reusable downstream. (AC: Add @claude delegation, auto-merge, and rebase handling #3)

Dev Notes

• HANDS-OFF / cross-repo: this work spans petry-projects/.github and downstream consumer repos, which dev-lead cannot modify from within .github-private. Treat as a human-coordinated rollout (mirrors the existing fan-out epics [Fan-out] dev-lead self-host pin (trigger stub + reusable-only + agent_ref) #535/[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged) #536 for dev-lead/pr-review pins).
• Depends on the in-repo standard + compliance test being proven first (stories id 3 and id 5) — dogfood-first per the Safe Release Strategy (docs/initiatives/agentic-release-strategy.md): ring-0 is .github-private itself.
• AGENTS.md already flags the promotion path: the repo-local pinning standard becomes org-wide by lifting it into petry-projects/.github and having repos defer to it. Reuse that mechanism rather than inventing a new one.
• Migration order (discussion open question) must avoid breaking in-flight consumers: repin .github-private (done in Phase 2), then downstream rings, verifying each before advancing.

Project Structure Notes

Primarily out-of-repo (petry-projects/.github + consumer repos). In-repo footprint is limited to documentation cross-links; the executable changes live in other repos.

References

• AGENTS.md (Promotion: lift repo-local standard into petry-projects/.github)
• docs/initiatives/agentic-release-strategy.md (dogfood-first, ring-0 = .github-private)
• templates/ci-failure-analyst.yml (deployed downstream)
• open epics [Fan-out] dev-lead self-host pin (trigger stub + reusable-only + agent_ref) #535/[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged) #536 (existing pr-review/dev-lead fan-out pattern to mirror)

Likely target surface

• petry-projects/.github (org AGENTS.md / standards)
• downstream consumer repos: .github/workflows/ci-failure-analyst.yml

Story prepared by the BMAD Scrum Master (Bob) for epic #684. Status: ready-for-dev.