Consolidate repeated retired-link consumer validation jobs #762

🤖 Generated by the Agentic Engineer

Problem and outcome

The immutable-source survey in monorepo #4525 found the same retired-repository-link consumer validation job copied across repositories. The validator itself is already shared; its clean-tree, forbidden-link, missing-configuration and scoped-fixture wiring is repeated around it. Fixing those copies independently causes drift.

Consolidate that repeated job in the catalogue while keeping repository-specific configuration and genuinely local assertions in their owners. This is a behavior-preserving refactor, not permission to delete refusal tests or make validation optional. Keep organization-required workflows for cross-product PR concerns; use an ordinary reusable job with demonstrated callers for this consumer test harness.

Observed source

At the survey's 25 October snapshot, complete step lists match in dotnet-template/platform-template, agent-skills/wedding-app, and unifi/aws/kyverno-policies/cloudflare. Related repeated sequences also appear in KSail, agent-plugins and AS Coaching's local documentation composite. All are in .github/workflows/ci.yaml, except AS Coaching's .github/actions/documentation-links/action.yaml. The survey records each exact source revision and the meaningful differences.

Acceptance criteria

• Re-read the complete live workflow/composite caller inventory and compare job-level permissions, conditions, deadlines, aggregate dependencies, action pins and local fixture assertions before selecting a common interface. Preserve differences that represent real product contracts.
• Put only the repeated read-only consumer validation in a reusable catalogue job with at least two real callers. Reuse the existing validator action; do not copy or replace its implementation. Inputs must be narrowly typed data, never arbitrary commands, credentials or candidate-selected executor code.
• Preserve actual clean-tree success and refusal for retired links, missing configuration, skipped/disabled validation, wrong scope and incomplete evidence. Retain each caller's non-overlapping configuration and repository-specific refusal coverage.
• Deliver a reviewed immutable release and migrate the two identical template callers first through their native CI and substantive reviews. Then update every compatible caller from the complete inventory, or record a concrete keep-local reason for an incompatible one.
• Keep read-only permissions, immutable pins, finite existing deadlines, required aggregate coverage and failure/cancellation behavior. Do not change protected check identities or weaken enforcement as an incidental refactor.
• Compare native complete job graphs and execution/queue time before and after for equivalent changed-path inputs. Report source consolidation separately from any measured runtime effect.
• Remove only the superseded wrapper copies after native caller success, and update catalogue action/workflow documentation consistently. Existing generic scanner and retired-link guarantees remain mandatory.

Priority: Medium; Effort: Medium. This removes observed maintenance duplication; it is not live breakage and does not establish a measured CI speedup. Keep deferred until finishing higher-priority in-flight work.

Part of #287. Discovery and decision: monorepo #4525.