DEVEX-1653: add rt_mode to build-php-v1 orchestrator

[pdodgen-revparts]

Description

Adds an rt_mode: boolean input to the shared build-php-v1 orchestrator. When true (caller triggers on rt-* refs), the orchestrator routes through encodium/actions' _compute-rt-tag composite to push the rt rc tag and create the GH pre-release atomically up front; build then consumes that tag. When false (default) behavior is identical to today.

Related PRs:

• https://github.com/encodium/listings-url-service/pull/89 (pilot — inline rt-build today; will migrate to this orchestrator in Phase 3)
• https://github.com/encodium/license_api/pull/99 (draft — to be revised to use this extended orchestrator instead of the hybrid pattern)

Jira Issue: https://revolutionparts.atlassian.net/browse/DEVEX-1653

Background

Release Train v2 (DEVEX-1579) ships images tagged vX.Y.Z-rc.<YYYY-MM-DD>.<iter> from per-train rt-<YYYY-MM-DD> branches. The pilot (listings-url-service#89) proved the inline pattern works, but copying ~80 lines of rt-build logic into every consuming app's Build.yaml would mean 4 near-identical inline jobs to maintain (internal_api, rp_api, listings-url-service, license_api).

By teaching build-php-v1 about rt mode, Phase 3 per-repo PRs become a few lines: a second rt-build job that calls the orchestrator with rt_mode: true and a different images JSON (no extra_tag: latest for rt builds). Tag-emission logic and GH Release creation stay in one place — the composite action.

The non-rt path is preserved verbatim. The two paths are mutually exclusive at job level (if: ${{ !inputs.rt_mode }} vs if: ${{ inputs.rt_mode }}); build waits on both with always() && (success of either) and selects the active tag via ||.

Scope of this PR (and what's deferred):

• ✅ build-php-v1.yaml: extended.
• ⏭️ build-php-laravel.yaml: intentionally not extended here. The Laravel worker hardcodes :latest / :webserver-latest / :cli-latest across 6 build jobs — safely supporting rt mode there requires an omit_latest_tag input plumbed through the worker. That's a separate, larger PR. Among Phase 3 apps only returns-api consumes the Laravel orchestrator; it can use an inline rt-build path (matching the pilot) in the interim.
• ⏭️ accounts-api calls php-laravel-build-push.yaml directly (not the Laravel orchestrator) and catalog_api is fully inline — both will use inline rt-build paths in Phase 3.

Caller responsibilities

For an rt-build job calling this orchestrator with rt_mode: true:

• Gate on if: startsWith(github.ref, 'refs/heads/rt-')
• permissions: { contents: write } on the calling job (propagates into compute-rt-tag)
• Pass a token with contents:write via secrets.gh_token (the pilot uses REPO_WRITE_PAT)
• Use a separate images JSON without extra_tag: latest — rt builds shouldn't move :latest

Testing Information

• YAML syntax: lint-clean.
• Behavioral diff on non-rt path: zero. calculate-tag → build → tag-and-release chain runs identically; the only addition (compute-rt-tag) is gated on rt_mode == true and stays skipped.
• End-to-end rt path: validated in the sandbox rt-99 train against the foundational composite action prior to this PR. This PR is a packaging refactor — same composite, same emitted tag, called from one place instead of inlined per-repo.
• No-op on existing consumers: internal_api, rp_api, returns-api, license_api, listings-url-service all call this workflow without specifying rt_mode; the default (false) preserves their current behavior.

Phase 3 follow-up PRs (one per consuming repo) will exercise rt_mode end-to-end before any per-repo merge.

[cursor]

PR Summary

Medium Risk
Changes shared release orchestration and adds a path that pushes tags and creates GitHub releases with write permissions; default rt_mode false limits blast radius for current consumers.

Overview
Adds optional rt_mode (default false) to the reusable build-php-v1 workflow so Release Train builds can share one orchestrator instead of per-repo inline jobs.

When rt_mode: true, the workflow skips the existing mathieudutour dry-run / tag-and-release tail and runs a new compute-rt-tag job that calls encodium/actions’ _compute-rt-tag composite (with contents: write) to push the rt rc tag and create the GitHub pre-release up front. build then tags images from that output. When rt_mode: false, the calculate-tag → build → tag-and-release chain is unchanged aside from gating.

build now depends on both tag jobs and uses always() plus a success check on whichever path ran; the image tag input and workflow outputs.tag use || to pick the active job’s tag. Callers on rt branches must pass a write-capable token and avoid extra_tag: latest in their images matrix.

^{Reviewed by Cursor Bugbot for commit 7a67e2e. Bugbot is set up for automated code reviews on this repo. Configure here.}