Agree the Process-PSModule caller workflow structure #514

Outcome

The Process-PSModule caller workflow structure is explicitly agreed before canonical guides, templates, or consumer repositories change. The inventory and candidate YAML provide evidence for the decision; they do not establish the standard by themselves.

Evidence

• Draft PR: ⚙️ [Maintenance]: Process-PSModule caller fleets can be audited consistently #515
• Current inventory: 60 default-branch caller workflows, with all dimensions captured in the generated fleet inventory.
• Candidate design: docs/content/reference/process-workflow-fleet-standard.md in PR ⚙️ [Maintenance]: Process-PSModule caller fleets can be audited consistently #515.
• Agreed reference policy: controlled PSModule-owned automation may use a floating major tag such as @v8; external automation remains full-SHA pinned.

Recommendations for review

These are recommendations, not decisions. The checklist below remains the approval record.

Structural decisions to approve

• Contract scope: require the complete canonical Process-PSModule.yml; repository-owned automation uses separate workflow files.
• Trigger ownership: which of manual dispatch, schedule, default-branch push, and pull-request events belong in every caller.
• Pull-request activities: whether all of closed, opened, reopened, synchronize, labeled, and unlabeled are mandatory.
• Concurrency: use workflow plus PR number or full github.ref; set cancel-in-progress to ${{ github.event_name == 'pull_request' }}.
• Permissions: default deny globally; grant the caller job contents: read, pages: write, and id-token: write; use scoped GitHub App tokens for user-facing interactions and operations beyond the built-in token boundary.
• Fork behavior: keep the caller unconditional; let Plan authorize restricted fork validation while denying App tokens, publication, deployment, cleanup, and mutations.
• Credentials: require the three explicit v8 mappings; allow optional TestData JSON with separate secrets and variables maps; do not use secrets: inherit.
• Optional surface: TestData is the only permitted variation from the canonical template.
• Identity: final file, workflow, and job names used for discovery and stable checks.

Scope

• Inventory every default-branch workflow that calls PSModule/Process-PSModule/.github/workflows/workflow.yml.
• Record workflow identity, triggers, concurrency, permissions, reference, inputs, secrets, and extra jobs.
• Compare the evidence with the v8 producer contract.
• Record each approved structural decision and its rationale.
• Update canonical documentation only after the checklist above is resolved.

Non-goals

• Do not modify caller workflows across the fleet in this task.
• Do not treat the candidate YAML as approved merely because it appears in documentation or a draft PR.
• Do not start the rollout campaign until this issue records the agreed structure.

Acceptance criteria

• The complete current repository list and workflow metadata are documented.
• GitHub and local-checkout inventory refresh paths are tested.
• Every structural decision above has an explicit outcome.
• Required elements and optional variations use the approved outcomes rather than inferred commonality.
• Canonical guides and templates are updated only after approval.
• Campaign issue ⚙️ [Maintenance]: [process-v8-major-tag] Roll the v8 caller across the fleet #438 references the approved decision record.