[astrojuanlu]

What

Replace the three separate workflows (test.yaml, tag.yaml, propagate.yaml) with a single Template CI workflow (three jobs) so the pipeline is visible as one run instead of three loosely-related ones.

pull_request          -> test
push (main)           -> test -> tag -> propagate
workflow_dispatch     -> propagate only (optional tag input)

Details

• Tests now gate the tag (agreed): tag has needs: test, so a red main no longer tags, and propagate has needs: tag — nothing broken reaches the plugin repositories. Previously all three fired independently.
• Job names and concurrency groups are preserved (Test template, tag serialization, propagate-template); permissions moved to job level (tag: contents write, propagate: contents read), with an empty top-level permissions: {}.
• The propagate job keeps resolving the latest tag at runtime (instead of a hard dependency on the tag job's output), which preserves two existing behaviors: propagation after manual tag pushes (where the tag job is a no-op) and manual re-runs via workflow_dispatch with an optional tag.
• On PRs, tag/propagate show as skipped jobs; PR checks keep the same name.

Verification

• YAML parses; job set is exactly {test, tag, propagate}.
• Logic reviewed against all three trigger paths. First real exercise will be the merge to main itself (test → tag → propagate).

Assisted-by: OpenRouter:z-ai/glm-5.3-flash pi