Support both the legacy hardcoded URL format and the new
\${PACKAGE_BASE_URL}/... template format in lockfile entries.
Resolves \${PACKAGE_BASE_URL} to the stable base URL before
downloading wheels for size calculations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Wheels are now uploaded to dev/{artifact_type}/{project_name}/ paths
in GCS instead of the unprefixed paths. Lockfile entries are templated
with \${PACKAGE_BASE_URL} so pip resolves the URL at install time using
either the dev or stable base URL depending on the environment.

Also fix brittle index extraction in generate_artifact_listings and
list_wheels_with_prefix to use split('/')[-1] and split('/')[-2]
instead of hardcoded indices.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Lockfiles now use \${PACKAGE_BASE_URL}/... template entries instead of
hardcoded URLs. Update url_to_blob_path to extract the relative path
from \${PACKAGE_BASE_URL}/... entries, then prepend dev/ when looking up
blobs in GCS and stable/ for the promotion destination.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Instead of creating a separate PR with updated lockfiles, the publish
job now commits them directly to the PR branch. This collapses the
two-PR dependency update workflow into a single PR.

- Trigger: pull_request only (remove push and workflow_dispatch)
- Permission: contents: write (needed for git push)
- Token: GitHub App token checked out before checkout so push works
- Replace peter-evans/create-pull-request with a git commit + push step

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

promote-gate.yaml runs on every PR push to master/7.*.*. If dependency
files (agent_requirements.in or .deps/resolved/) changed, it sets the
promote-wheels commit status to pending, blocking merge. Otherwise it
sets it to success (no promotion needed).

promote-wheels.yaml is triggered via workflow_dispatch (by ddev promote).
It checks out the PR branch at the given SHA, runs .builders/promote.py
to copy wheels from dev/ to stable/ in GCS, then sets the promote-wheels
commit status to success and posts a comment on the PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test_upload.py: update all blob path assertions to use dev/ prefix
and all lockfile URL assertions to use \${PACKAGE_BASE_URL} format.
Update generate_artifact_listings assertions to use dev/-prefixed paths.

test_promote.py (new): test lockfile parsing, url_to_blob_path,
collect_relative_paths, GCS copy with correct dev/stable paths,
idempotency, and failure on missing source blobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Rename promote-gate.yaml -> dependency-wheel-promotion-gate.yaml and
promote-wheels.yaml -> dependency-wheel-promotion.yaml so the two
related workflows sort next to each other and their purpose is explicit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The actions/checkout shallow clone does not include the base branch,
so git diff --name-only against origin/<base> fails. Replace the git
command with a GitHub API call (pulls.listFiles) which does not require
a checkout at all.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fork PRs cannot access repo secrets (GCS credentials, GitHub App key)
or the Workload Identity Provider used by google-github-actions/auth.
Add !github.event.pull_request.head.repo.fork to the publish job condition
so it only runs on PRs from branches within the repo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ddev dep promote <PR_URL> extracts the PR number from the URL, fetches
the head SHA and branch from the GitHub API, then dispatches the
dependency-wheel-promotion workflow via workflow_dispatch.

This avoids both wasted runner minutes (no issue_comment polling) and
new infrastructure (no webhook handler). The workflow only runs when
explicitly dispatched.

Also add get_pr_head() and dispatch_workflow() to GitHubManager.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>