fix(workflows): publish-on-tag hardening + umbrella support

[jadb]

Summary

Hardens publish-on-tag.yml for the failure modes seen during the
first multi-component publish runs in hop-top/poly-cite and adds
the docs / ADR coverage to keep follow-on adopters from re-hitting
the same edges.

publish-on-tag.yml

• Umbrella / meta-component tags now skip cleanly. parse.lookup
  used to hard-fail with ::error::Unknown component when a tag's
  component prefix had no entry in the caller's ecosystems map.
  release-please umbrella bumps (the . root in a separate-PRs
  manifest, e.g. poly-cite/v0.1.0) hit this path by design and
  reddened otherwise-clean release runs. Replaced with a
  ::notice:: + empty outputs; every downstream job (publish-ts,
  publish-py, publish-rs, mirror, publish-php) now gates on
  needs.parse.outputs.ecosystem != '' so the workflow finishes
  green with all publish jobs marked skipped.

• publish-php no longer reds out when Packagist credentials
  aren't forwarded. PACKAGIST_USERNAME / PACKAGIST_TOKEN are
  already declared in the workflow_call secrets: block, but a
  caller that hadn't wired them got ::error::… must be provided

  • exit 1. Switched to ::notice:: + exit 0 — "no credentials"
    means "don't notify Packagist," not "fail the release." Hard-fail
    belongs in the preflight, not the publish path. (secrets.*
    cannot appear in job-level if:, so the gate stays in the step
    body.)

release-please.yml

• workflow_dispatch: {} added so the bot's standing PRs can be
  rebuilt against current main on demand after sibling-PR conflicts
  force a rebase. Previously required a no-op commit to main.

Docs (SKILL.md, references/quick-start.md)

• New SKILL.md sections: Umbrella / meta-component tags,
  Bootstrap-mirror gotcha (two safe shapes — empty mirror or
  pre-populated via git subtree split at the tag's source commit
  — plus recovery on non-fast-forward and rationale for not
  defaulting to --force-push), and Re-runs use the tag's
  workflow snapshot, not main (with the two recovery paths:
  delete + recreate tag, or cut a new patch tag).
• Caller templates (SKILL.md TL; DR + references/quick-start.md)
  now show workflow_dispatch: {} on the caller publish.yml,
  with a caveat comment about snapshot semantics so adopters know
  the trade-off up front.
• Three new rows in the "find your intent" table.

docs/adr/0001-release-please-rebase-automation.md

• ADR proposing how to handle the O(N²) manifest-conflict
  cascade under release-please-action separate-pull-requests: true.
  Four options considered (upstream native rebase — no flag exists
  today; local release-please-rebase.yml reusable; single-PR mode
  — regresses per-component review; community auto-rebase actions
  — can't resolve manifest semantics). Decision: file upstream AND
  scope the reusable in parallel; retire the reusable when upstream
  lands a fix. Implementation out of scope — separate task.

Test plan

• actionlint .github/workflows/*.yml passes locally.
• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/publish-on-tag.yml'))" succeeds.
• Dispatch a synthetic umbrella tag (<name>/v0.0.1 with no ecosystems entry) on a sandbox caller repo; expect the workflow to finish green with every publish job skipped.
• Dispatch a php tag from a caller that has NOT wired PACKAGIST_USERNAME / PACKAGIST_TOKEN; expect publish-php to finish with the ::notice:: and the run to be green overall.
• Trigger release-please.yml via gh workflow run release-please.yml --ref main and confirm the bot PRs are rebuilt.
• Confirm the caller publish.yml example in references/quick-start.md is copy-paste-safe (no leftover comment-only lines, valid YAML).

Notes

• One of the original tasks in scope (forward RELEASE_BOT_* secrets
  • gate the notify-vanity job) was already retired in commit
    e775e3b (docs(skill): vanity-URL resolver + retire #50's notify-vanity mechanism #52) when the notify-vanity job was removed; the secrets
    are no longer referenced anywhere in publish-on-tag.yml. Vanity-
    URL resolution now lives in the hop-top/hop.top Cloudflare
    Worker + homebrew-tap overrides per
    references/concepts/vanity-imports.md. That task was closed as
    N/A; no publish-on-tag.yml change shipped for it here.