Run production validation from release workflow

[rusenask]

Summary

• allow the reusable production validation job when invoked by the tag-driven release workflow
• retain the explicit production confirmation requirement for manual dispatches
• add a workflow regression assertion for the event condition

Evidence

• release run 34393723220 passed source, immutable image publication, and amd64/arm64 smoke validation, then skipped production because reusable workflows retain the caller event (push)
• make release-workflow-test
• git diff --check

Release safety

The skipped run did not promote the version image, chart, latest tag, or GitHub Release. The commit-scoped staging image remains retry-safe.

---

Note

Medium Risk
Changes when production k3s validation runs in the release path, affecting release gating before promote/chart steps, though manual production runs still require explicit confirmation.

Overview
Fixes production live validation being skipped when the release pipeline calls the reusable production-e2e workflow. Reusable runs inherit the caller’s event (e.g. push on tag), so the old guard that only allowed workflow_call or manual confirmation never matched and the job did not run.

The job if is now github.event_name != 'workflow_dispatch' || inputs.confirmation == 'production', so tag-driven release calls proceed while manual workflow_dispatch still requires typing production.

.test/release-workflow.sh pins that condition with a grep assertion so the behavior cannot regress silently.

^{Reviewed by Cursor Bugbot for commit e7afb5d. Configure here.}