Epic: dagger migration + full gitflow automation

[haydenk]

End-to-end migration of CI/release pipeline to dagger functions, with full gitflow automation.

Goals

• Pipeline logic in dagger (Go SDK, .dagger/) — runnable locally and in CI from the same source.
• Full feature→develop→release/*→master→tag→release→back-merge automation.

Constraints

• PAT-less: only GITHUB_TOKEN + workflow_call + branch-protection bypass for github-actions[bot].
• Third-party-action-free: only official GitHub actions (actions/*) and tool-upstream actions (docker/*, dagger/*, hadolint/*, jdx/mise-*).
• Date-based tag convention preserved (YYYYMMDD / YYYYMMDD.NN).

Reference

Patterns mirror haydenk/homestead.

Phases & issues

Phase 1 — Branch Policy Foundation

• Branch policy: ValidateBranchPolicy dagger fn + branch-policy.yml #15 — Branch policy: ValidateBranchPolicy dagger fn + branch-policy.yml

Phase 2 — Release Automation

• Make release.yml callable: workflow_call + dry_run + RELEASE_TAG #16 — Make release.yml callable (workflow_call + dry_run + RELEASE_TAG)
• Dagger Notes fn + gh release create: remove softprops/action-gh-release #20 — Dagger Notes fn + gh release create (remove softprops/action-gh-release)
• gitflow-release.yml: tag + back-merge + invoke release on master merge (replaces tag.yml) #21 — gitflow-release.yml replacing tag.yml (tag + back-merge + invoke release)

Phase 3 — Protection & Policy

• Branch protection rulesets: master + develop (with github-actions[bot] bypass on develop) #22 — Branch protection rulesets on master/develop (HITL)

Phase 4 — Dagger CI Migration

• Dagger Lint fn: replace hadolint/hadolint-action in CI #17 — Dagger Lint fn (replace hadolint/hadolint-action)
• Dagger Test fn: replace inline docker run asserts in CI #18 — Dagger Test fn (replace inline docker run asserts)
• Dagger Build fn (CI side only) #19 — Dagger Build fn (CI side only)

Phase 5 — Developer Experience

• Local-reproducibility helper: dagger call ci #23 — dagger call ci local-reproducibility helper

Landing order

#15 → #16 → #20 → #21 → #22, with #17 / #18 / #19 running in parallel any time after #15, then #23 once #17/#18/#19 land.