ci: Validate datasqrl-examples against snapshot images and auto-bump on release

[velo]

Summary

Two cross-repo CI wiring changes for DataSQRL/datasqrl-examples:

1. PR/main validation against snapshot images — A new examples-validation job dispatches datasqrl-examples's build workflow with the freshly-built image (ghcr.io/datasqrl/cmd:pr-N for PRs, datasqrl/cmd:dev for main) and waits for it to finish. Failures in the examples build now fail this repo's CI.
2. Auto-bump PR on release — New workflow bump-examples-version.yml triggers on release: published and opens a PR against datasqrl-examples bumping SQRL_VERSION (shape matches datasqrl-examples#105). Idempotent — skips if a PR for that version already exists. Also exposed via workflow_dispatch for manual bumps.

Supporting change:

• CircleCI build-images — Loosened the halt so PR builds also push to ghcr.io/datasqrl/cmd:pr-N and ghcr.io/datasqrl/sqrl-server:pr-N. Without this, downstream CI has nothing to pull on PRs. Tagged releases and main=:dev behavior on Docker Hub are unchanged.

Requirements

• BOT_PAT secret in this repo with: contents: write, pull-requests: write, actions: write (dispatch) and actions: read (poll) on DataSQRL/datasqrl-examples.
• The companion PR in datasqrl-examples must land first — this PR's examples-validation job will fail until datasqrl-examples main has the workflow_dispatch inputs and run-name.

Notes

• PR images will now accumulate under ghcr.io/datasqrl/cmd and ghcr.io/datasqrl/sqrl-server. cleanup-packages.yml today only prunes Maven packages — consider extending it to prune Docker PR tags older than N days (out of scope for this PR).

Test plan

• Pair PR in datasqrl-examples is merged first
• BOT_PAT secret is configured in sqrl repo
• PR CI dispatches the examples build, locates the run, watches it to completion
• Cutting a new GitHub release publishes a PR in datasqrl-examples bumping SQRL_VERSION

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 13.35%. Comparing base (e5914ac) to head (46b6f99).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2075   +/-   ##
=========================================
  Coverage     13.35%   13.35%           
  Complexity      841      841           
=========================================
  Files           606      606           
  Lines         17516    17516           
  Branches       2122     2122           
=========================================
  Hits           2340     2340           
  Misses        14960    14960           
  Partials        216      216           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ferenc-csaky]

I don't think this should be executed for every PR or commit that makes it into main.

Ideally that would be nice, but IMO in real life that will be just another annoying step we just skip most of the time, and will be red until we release anyways.

WDYT?

[velo]

I don't think this should be executed for every PR or commit that makes it into main.

Ideally that would be nice, but IMO in real life that will be just another annoying step we just skip most of the time, and will be red until we release anyways.

WDYT?

well, if we don't run this on every PR, we will only know it's broken after someone manually checks